TI-2022-01345 CVE-2022-1471 · GHSA-mjmj-j48q-9wg2
Remote Code execution in SnakeYAML
Priority CRITICAL 88
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.
snakeyaml
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
snakeyaml records in CISA KEVNo snakeyaml vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records in Snakeyaml · all components
TI-2022-18262 CVE-2022-38752 · GHSA-9w3m-gqgf-c4p9
DoS in SnakeYAML
Priority MEDIUM 62
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).
TI-2017-13794 CVE-2017-18640 · GHSA-rvwf-54qp-4r6v
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load…
Priority MEDIUM 55
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
TI-2022-09423 CVE-2022-25857 · GHSA-3mc7-4q67-w48m
Denial of service (DoS) in org.yaml:snakeyaml
Priority LOW 38
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
TI-2022-18261 CVE-2022-38751 · GHSA-98wm-3w3q-mw94
DoS in SnakeYAML
Priority LOW 33
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).
TI-2022-18259 CVE-2022-38749 · GHSA-c4r9-r8fh-9vj2
DoS in SnakeYAML
Priority LOW 33
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).
TI-2022-20206 CVE-2022-41854 · GHSA-w37g-rhq8-7m4j
Stack Overflow in Snakeyaml
Priority LOW 32
Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).
TI-2022-18260 CVE-2022-38750 · GHSA-hhhw-99gj-p3c3
DoS in SnakeYAML
Priority LOW 31
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).