CVE-2022-38752

MEDIUM

snakeyaml < 1.32 - Denial of Service via Stack Overflow in YAML Parser

Title source: llm

Description

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

References (4)

Core 4

Core References

Third Party Advisory

https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081

Permissions Required

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47081

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240315-0009/

Third Party Advisory vendor-advisory

https://security.gentoo.org/glsa/202305-28

Scores

CVSS v3 6.5

EPSS 0.0202

EPSS Percentile 78.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-121 CWE-787

Status published

Products (2)

org.yaml/snakeyaml 0 - 1.32Maven

snakeyaml_project/snakeyaml < 1.32

Published Sep 05, 2022

Tracked Since Feb 18, 2026