CVE-2022-38751 — DoS in SnakeYAML

Affected: SnakeYAML

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

USN-5944-1 — snakeyaml vulnerabilities

Affected: Ubuntu:Pro:14.04:LTS: snakeyaml, Ubuntu:Pro:16.04:LTS: snakeyaml, Ubuntu:18.04:LTS: snakeyaml, Ubuntu:20.04:LTS: snakeyaml, Ubuntu:22.04:LTS: snakeyaml

It was discovered that SnakeYAML did not limit the maximal nested depth for collections when parsing YAML data. If a user or automated system were tricked into opening a specially crafted YAML file, an attacker could possibly use this issue to cause applications using SnakeYAML to crash, resulting in a denial of service. (CVE-2022-25857, CVE-2022-38749, CVE-2022-38750)

It was discovered that SnakeYAML did not limit the maximal data matched with regular expressions when parsing YAML data. If a user or automated system were tricked into opening a specially crafted YAML file, an attacker could possibly use this issue to cause applications using SnakeYAML to crash, resulting in a denial of service. (CVE-2022-38751)

Most recent entries from all

CVE-2022-38751 — DoS in SnakeYAML

USN-5944-1 — snakeyaml vulnerabilities