Remote Code execution in SnakeYAML
Priority CRITICAL 88CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 25 fixed, 18 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.99501 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Partial org.yaml:snakeyaml (Maven): 2.0Red Hat: 26 advisoriesRed Hat: 25 fixed, 18 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| snakeyaml | SnakeYAML | up to 2.0 | — | No fix listed | CNA |
| — | org.yaml:snakeyaml (Maven) | before 2.0 | 2.0 | Patch available | GHSA-mjmj-j48q-9wg2 |
- SnakeYAML Vendorsnakeyaml Affected up to 2.0 Fixed in — No fix listed CNA
- org.yaml:snakeyaml (Maven) Vendor— Affected before 2.0 Fixed in 2.0 Patch available GHSA-mjmj-j48q-9wg2
Remediation
- Fix · GHSA-mjmj-j48q-9wg2 org.yaml:snakeyaml (Maven) Fixed in 2.0 Advisory →
Red Hat 26 advisories
- RHSA-2025:1747 Released 2025-02-24 · Red Hat rating CriticalRed Hat JBoss Enterprise Application Platform 7.3.12 security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-hal-console-3.2.17-1.Final_redhat_00001.1.el7eap, eap7-jackson-annotations-2.10.4-2.redhat_00004.1.el7eap, eap7-jackson-core-2.10.4-2.redhat_00004.1.el7eap +38
- RHSA-2025:1746 Released 2025-02-24 · Red Hat rating CriticalRed Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-4.redhat_00003.1.ep7.el7, eap7-apache-cxf-services-3.1.16-4.redhat_00003.1.ep7.el7 +26
- RHSA-2024:1353 Released 2024-03-18 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.5 security update
- RHPAM 7.13.5 async
Show 23 more Red Hat advisories
- RHSA-2024:0775 Released 2024-02-12 · Red Hat rating Importantjenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1706516946-1.el8, jenkins-2.426.3.1706516929-3.el8
- RHSA-2024:0325 Released 2024-01-22 · Red Hat rating ImportantUpdated RHEL-7-based Middleware container images
- Middleware RHEL 7 Containers for OpenShift openjdk/openjdk-11-rhel7, redhat-openjdk-18/openjdk18-openshift
- RHSA-2023:7697 Released 2023-12-07 · Red Hat rating ModerateAMQ Clients 2023.Q4
- Red Hat AMQ Clients
- RHSA-2023:6171 Released 2023-10-30 · Red Hat rating CriticalRed Hat Product OCP Tools 4.11 Openshift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1698299029-1.el8, jenkins-2.414.3.1698298955-3.el8
- RHSA-2023:5165 Released 2023-09-14 · Red Hat rating ImportantRed Hat AMQ Streams 2.5.0 release and security update
- Red Hat AMQ Streams 2.5.0
- RHSA-2023:4612 Released 2023-08-16 · Red Hat rating ImportantRed Hat support for Spring Boot 2.7.13 security update
- Red Hat support for Spring Boot 2.7.13
- RHSA-2023:3198 Released 2023-05-17 · Red Hat rating Criticaljenkins and jenkins-2-plugins security update
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1683009941-1.el8, jenkins-2.387.1.1683009763-3.el8
- RHSA-2023:2097 Released 2023-05-03 · Red Hat rating ImportantSatellite 6.13 Release
- Red Hat Satellite 6.13 for RHEL 8 ansible-collection-redhat-satellite-3.9.0-2.el8sat, ansible-collection-redhat-satellite_operations-1.3.0-2.el8sat, ansible-lint-5.0.8-4.el8pc +47
- RHSA-2023:1516 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 security update
- Red Hat JBoss Enterprise Application Platform com.h2database.h2-1.4.197.redhat-00004.jar, io.netty.netty-codec-haproxy-4.1.86.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.23.SP2-redhat-00001.jar +3
- RHSA-2023:1512 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el7eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el7eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el7eap +47
- RHSA-2023:1513 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el8eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el8eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el8eap +47
- RHSA-2023:1514 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el9eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el9eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el9eap +47
- RHSA-2023:1006 Released 2023-03-08 · Red Hat rating ImportantRed Hat build of Quarkus 2.7.7 release and security update
- Red Hat build of Quarkus 2.7.7
- RHSA-2023:1043 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
- RHSA-2023:1049 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update
- Red Hat Single Sign-On 7
- RHSA-2023:1047 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2023:1045 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
- RHSA-2023:1044 Released 2023-03-01 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.2 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso
- RHSA-2023:0777 Released 2023-02-23 · Red Hat rating CriticalOpenShift Container Platform 4.9.56 security update
- Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins-4.9.1675668922-1.el8, jenkins-2.361.1.1675668150-1.el8
- RHSA-2023:0697 Released 2023-02-15 · Red Hat rating ImportantOpenShift Container Platform 4.10.52 security update
- Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins-4.10.1675407676-1.el8, jenkins-2.361.1.1675406172-1.el8
- RHSA-2023:0758 Released 2023-02-14 · Red Hat rating ModerateRed Hat build of Quarkus 2.13.7 release and security update
- Red Hat build of Quarkus
- RHSA-2022:9058 Released 2022-12-15 · Red Hat rating Importantprometheus-jmx-exporter security update
- Red Hat Enterprise Linux AppStream (v. 8) prometheus-jmx-exporter-0.12.0-9.el8_7, prometheus-jmx-exporter-openjdk11-0.12.0-9.el8_7, prometheus-jmx-exporter-openjdk17-0.12.0-9.el8_7 +1
- RHSA-2022:9032 Released 2022-12-15 · Red Hat rating ImportantRed Hat build of Eclipse Vert.x 4.3.4 security update
- Red Hat build of Eclipse Vert.x 4.3.4
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| A-MQ Clients 2 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix planned: Will not fix |
| Red Hat Integration Service Registry | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix yet |
| streams for Apache Kafka | Affected | No fix yet |
| Middleware Containers for OpenShift | Fixed | RHSA-2023:1047 |
| Middleware RHEL 7 Containers for OpenShift | Fixed | RHSA-2024:0325 |
| OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 | Fixed | RHSA-2023:3198, RHSA-2023:6171, RHSA-2024:0775 |
| RHPAM 7.13.5 async | Fixed | RHSA-2024:1353 |
| Red Hat AMQ Clients | Fixed | RHSA-2023:7697 |
| Red Hat AMQ Streams 2.5.0 | Fixed | RHSA-2023:5165 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2022:9058 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2023:1512 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2023:1513 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2023:1514 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2023:1516 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2025:1746 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2025:1747 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2023:0697 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2023:0777 |
| Red Hat OpenShift Dev Spaces 3 | Fixed | — |
| Red Hat Satellite 6.13 for RHEL 8 | Fixed | RHSA-2023:2097 |
| Red Hat Single Sign-On 7 | Fixed | RHSA-2023:1049 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2023:1043 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2023:1044 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2023:1045 |
| Red Hat build of Eclipse Vert.x 4.3.4 | Fixed | RHSA-2022:9032 |
| Red Hat build of Quarkus | Fixed | RHSA-2023:0758 |
| Red Hat build of Quarkus 2.7.7 | Fixed | RHSA-2023:1006 |
| Red Hat support for Spring Boot 2.7.13 | Fixed | RHSA-2023:4612 |
Not affected: 19 products
- Logging Subsystem for Red Hat OpenShift
- OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
- Red Hat A-MQ Online
- Red Hat AMQ Broker 7
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift Container Platform 4.10
- Red Hat OpenShift Container Platform 4.9
- Red Hat OpenShift Dev Spaces 3
- Red Hat Satellite 6.13 for RHEL 8
- Red Hat build of Apicurio Registry 2
- Red Hat build of Debezium 1
- Red Hat build of OpenJDK 11
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1471
- 2026-10-03 Alias added: GHSA-mjmj-j48q-9wg2
- 2026-10-30 Fix available: Red Hat OpenShift Dev Spaces 3 · Red Hat
References
Exploit 3
Advisory 2
Other 15
- https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
- https://security.netapp.com/advisory/ntap-20230818-0015/
- http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2023/11/19/1
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c
- https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html
- https://security.netapp.com/advisory/ntap-20240621-0006
- https://security.netapp.com/advisory/ntap-20230818-0015
- https://bitbucket.org/snakeyaml/snakeyaml/wiki/CVE-2022-1471
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64876314
- https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64634374
- https://bitbucket.org/snakeyaml/snakeyaml/commits/acc44099f5f4af26ff86b4e4e4cc1c874e2dc5c4
- https://bitbucket.org/snakeyaml/snakeyaml/commits/5014df1a36f50aca54405bb8433bc99a8847f758
- https://bitbucket.org/snakeyaml/snakeyaml
More Snakeyaml vulnerabilities
- TI-2022-18262 DoS in SnakeYAML CVSS 3.1MEDIUM 6.5
- TI-2017-13794 The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load… CVSS 3.1HIGH 7.5
- TI-2022-09423 Denial of service (DoS) in org.yaml:snakeyaml CVSS 3.1HIGH 7.5
- TI-2022-18261 DoS in SnakeYAML CVSS 3.1MEDIUM 6.5
- TI-2022-18259 DoS in SnakeYAML CVSS 3.1MEDIUM 6.5
- TI-2022-20206 Stack Overflow in Snakeyaml CVSS 3.1MEDIUM 6.5
Sources
- CVE-2022-1471 · CVE Program
- CVE-2022-1471 · NVD
- FIRST EPSS
- GHSA-mjmj-j48q-9wg2 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-1471 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences