CVE-2022-41854

MEDIUM

SnakeYAML < 1.32 - Denial of Service via Stack Overflow in YAML Parser

Title source: llm

Description

Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.

References (6)

Core 6

Core References

Exploit, Issue Tracking, Third Party Advisory

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50355

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240315-0009/

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240621-0006/

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MKE4XWRXTH32757H7QJU4ACS67DYDCR/

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSPAJ5Y45A4ZDION2KN5RDWLHK4XKY2J/

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DDXEXXWAZGF5AVHIPGFPXIWL6TSMKJE/

Scores

CVSS v3 5.8

EPSS 0.0012

EPSS Percentile 30.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H

Details

CWE

CWE-121 CWE-787

Status published

Products (4)

fedoraproject/fedora 36

fedoraproject/fedora 37

org.yaml/snakeyaml 0 - 1.32Maven

snakeyaml_project/snakeyaml < 1.32

Published Nov 11, 2022

Tracked Since Feb 18, 2026