Read the docs
TI-2022-09423 Aliases CVE-2022-25857GHSA-3mc7-4q67-w48m

Denial of service (DoS) in org.yaml:snakeyaml

Priority LOW 38CWE-776Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 29 fixed, 16 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

Why it matters now

EPSS 0.02932 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.yaml:snakeyaml: 1.31org.yaml:snakeyaml (Maven): 1.31Red Hat: 32 advisoriesRed Hat: 29 fixed, 16 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—org.yaml:snakeyamlall versions; before 1.311.31Patch availableCNA
—org.yaml:snakeyaml (Maven)before 1.311.31Patch availableGHSA-3mc7-4q67-w48m
  • org.yaml:snakeyaml Vendor— Affected all versions; before 1.31 Fixed in 1.31 Patch available CNA
  • org.yaml:snakeyaml (Maven) Vendor— Affected before 1.31 Fixed in 1.31 Patch available GHSA-3mc7-4q67-w48m

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*before 1.31Vulnerablesnakeyaml
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:* Versions before 1.31 Vulnerable ·snakeyaml
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA org.yaml:snakeyaml Fixed in 1.31
  • Fix · GHSA-3mc7-4q67-w48m org.yaml:snakeyaml (Maven) Fixed in 1.31 Advisory →

Red Hat 32 advisories

  • RHSA-2025:4437 Released 2025-05-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.13 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-activemq-artemis-2.9.0-10.redhat_00021.1.el7eap, eap7-activemq-artemis-cli-2.9.0-10.redhat_00021.1.el7eap, eap7-activemq-artemis-commons-2.9.0-10.redhat_00021.1.el7eap +44
  • RHSA-2025:4226 Released 2025-04-28 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-activemq-artemis-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.016-1.redhat_00001.1.ep7.el7 +22
  • RHSA-2024:0778 Released 2024-02-12 · Red Hat rating Important
    Jenkins and Jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1706515741-1.el8, jenkins-2.426.3.1706515686-3.el8
Show 29 more Red Hat advisories
  • RHSA-2024:0777 Released 2024-02-12 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1706516441-1.el8, jenkins-2.426.3.1706516352-3.el8
  • RHSA-2024:0776 Released 2024-02-12 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1706516346-1.el8, jenkins-2.426.3.1706516254-3.el8
  • RHSA-2023:7697 Released 2023-12-07 · Red Hat rating Moderate
    AMQ Clients 2023.Q4
    • Red Hat AMQ Clients
  • RHSA-2023:7288 Released 2023-11-16 · Red Hat rating Important
    Red Hat Product OCP Tools 4.14 Openshift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1699356715-1.el8, jenkins-2.414.3.1699356615-3.el8
  • RHSA-2023:6179 Released 2023-10-30 · Red Hat rating Critical
    Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1698292274-1.el8, jenkins-2.414.3.1698292201-3.el8
  • RHSA-2023:6172 Released 2023-10-30 · Red Hat rating Critical
    Red Hat Product OCP Tools 4.12 Openshift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1698294000-1.el8, jenkins-2.414.3.1698293911-3.el8
  • RHSA-2023:4983 Released 2023-09-05 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.4 security update
    • RHPAM 7.13.4 async
  • RHSA-2023:3641 Released 2023-06-15 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.18.3 Patch 2 release
    • RHINT Camel-Springboot 3.18.3.P2
  • RHSA-2023:3198 Released 2023-05-17 · Red Hat rating Critical
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1683009941-1.el8, jenkins-2.387.1.1683009763-3.el8
  • RHSA-2023:2097 Released 2023-05-03 · Red Hat rating Important
    Satellite 6.13 Release
    • Red Hat Satellite 6.13 for RHEL 8 ansible-collection-redhat-satellite-3.9.0-2.el8sat, ansible-collection-redhat-satellite_operations-1.3.0-2.el8sat, ansible-lint-5.0.8-4.el8pc +47
  • RHSA-2023:2100 Released 2023-05-03 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.20.1 security update
    • RHINT Camel-Springboot 3.20.1
  • RHSA-2023:1043 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
  • RHSA-2023:1049 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update
    • Red Hat Single Sign-On 7
  • RHSA-2023:1047 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2023:1045 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
  • RHSA-2023:1044 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso
  • RHSA-2023:0777 Released 2023-02-23 · Red Hat rating Critical
    OpenShift Container Platform 4.9.56 security update
    • Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins-4.9.1675668922-1.el8, jenkins-2.361.1.1675668150-1.el8
  • RHSA-2023:0560 Released 2023-02-08 · Red Hat rating Critical
    OpenShift Container Platform 4.10.51 security update
    • Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins-4.10.1675144701-1.el8
  • RHSA-2022:8876 Released 2022-12-07 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.10.2 release and security update
    • Red Hat AMQ Broker 7
  • RHSA-2022:8652 Released 2022-11-28 · Red Hat rating Important
    Red Hat Fuse 7.11.1 release and security update
    • Red Hat Fuse 7.11.1
  • RHSA-2022:8524 Released 2022-11-17 · Red Hat rating Important
    Red Hat Data Grid 8.4.0 security update
    • Red Hat Data Grid 8.4.0
  • RHSA-2022:6941 Released 2022-10-13 · Red Hat rating Important
    Red Hat build of Quarkus Platform 2.7.6.SP1 and security update
    • Red Hat build of Quarkus Platform 2.7.6.SP1
  • RHSA-2022:6835 Released 2022-10-06 · Red Hat rating Important
    Service Registry (container images) release and security update [2.3.0.GA]
    • RHINT Service Registry 2.3.0 GA
  • RHSA-2022:6820 Released 2022-10-06 · Red Hat rating Moderate
    prometheus-jmx-exporter security update
    • Red Hat Enterprise Linux AppStream (v. 8) prometheus-jmx-exporter-0.12.0-8.el8_6, prometheus-jmx-exporter-openjdk11-0.12.0-8.el8_6, prometheus-jmx-exporter-openjdk17-0.12.0-8.el8_6 +1
  • RHSA-2022:6822 Released 2022-10-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.7 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-snakeyaml-1.31.0-1.redhat_00001.1.el8eap, eap7-undertow-2.2.19-1.SP2_redhat_00001.1.el8eap
  • RHSA-2022:6825 Released 2022-10-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.7 Security update
    • Red Hat JBoss Enterprise Application Platform io.undertow.undertow-core-2.2.19.SP2-redhat-00001.jar, org.yaml.snakeyaml-1.31.0.redhat-00001.jar
  • RHSA-2022:6821 Released 2022-10-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.7 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-snakeyaml-1.31.0-1.redhat_00001.1.el7eap, eap7-undertow-2.2.19-1.SP2_redhat_00001.1.el7eap
  • RHSA-2022:6823 Released 2022-10-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.7 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-snakeyaml-1.31.0-1.redhat_00001.1.el9eap, eap7-undertow-2.2.19-1.SP2_redhat_00001.1.el9eap
  • RHSA-2022:6757 Released 2022-10-05 · Red Hat rating Important
    Red Hat build of Eclipse Vert.x 4.3.3 security update
    • Red Hat build of Eclipse Vert.x 4.3.3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
A-MQ Clients 2AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat Integration Service RegistryAffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat support for Spring BootAffectedNo fix yet
streams for Apache KafkaAffectedNo fix yet
Middleware Containers for OpenShiftFixed RHSA-2023:1047
OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8Fixed RHSA-2023:3198
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2023:6172, RHSA-2024:0778
OpenShift Developer Tools and Services for OCP 4.13Fixed RHSA-2023:6179, RHSA-2024:0776
OpenShift Developer Tools and Services for OCP 4.14Fixed RHSA-2023:7288, RHSA-2024:0777
RHINT Camel-Springboot 3.18.3.P2Fixed RHSA-2023:3641
RHINT Camel-Springboot 3.20.1Fixed RHSA-2023:2100
RHINT Service Registry 2.3.0 GAFixed RHSA-2022:6835
RHPAM 7.13.4 asyncFixed RHSA-2023:4983
Red Hat AMQ Broker 7Fixed RHSA-2022:8876
Red Hat AMQ ClientsFixed RHSA-2023:7697
Red Hat Data Grid 8.4.0Fixed RHSA-2022:8524
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:6820
Red Hat Fuse 7.11.1Fixed RHSA-2022:8652
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2022:6821
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2022:6822
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2022:6823
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2022:6825
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:4226
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:4437
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2023:0560
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2023:0777
Red Hat Satellite 6.13 for RHEL 8Fixed RHSA-2023:2097
Red Hat Single Sign-On 7Fixed RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2023:1045
Red Hat build of Eclipse Vert.x 4.3.3Fixed RHSA-2022:6757
Red Hat build of Quarkus Platform 2.7.6.SP1Fixed RHSA-2022:6941
Not affected: 15 products
  • Logging Subsystem for Red Hat OpenShift
  • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • OpenShift Developer Tools and Services for OCP 4.12
  • OpenShift Developer Tools and Services for OCP 4.13
  • OpenShift Developer Tools and Services for OCP 4.14
  • Red Hat A-MQ Online
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.9
  • Red Hat Satellite 6.13 for RHEL 8
  • Red Hat build of Debezium 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-25857
  2. 2026-10-03 Alias added: GHSA-3mc7-4q67-w48m
  3. 2026-11-05 Affected versions changed · Red Hat

References

Exploit 1

Patch 2

Advisory 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences