TI-2022-18260 Aliases CVE-2022-38750 GHSA-hhhw-99gj-p3c3

DoS in SnakeYAML

LOW 31CWE-121Published 2022-09-05 · Updated 2024-11-20

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 11 fixed, 21 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-121 and the CVSS impact.

Summary

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01268 69th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Partial SnakeYAML (snakeyaml): 1.31org.yaml:snakeyaml (Maven): 1.31Red Hat: 11 advisoriesRed Hat: 11 fixed, 21 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
snakeyaml	SnakeYAML	before 1.31	1.31	Patch available	CNA
—	org.yaml:snakeyaml (Maven)	before 1.31	1.31	Patch available	GHSA-hhhw-99gj-p3c3

SnakeYAML Vendorsnakeyaml Affected before 1.31 Fixed in 1.31 Patch available CNA
org.yaml:snakeyaml (Maven) Vendor— Affected before 1.31 Fixed in 1.31 Patch available GHSA-hhhw-99gj-p3c3

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:snakeyaml_project:snakeyaml::::::::	before 1.31	Vulnerable	snakeyaml
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian

cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:* Versions before 1.31 Vulnerable ·snakeyaml
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

Fix · CNA SnakeYAML (snakeyaml) Fixed in 1.31
Fix · GHSA-hhhw-99gj-p3c3 org.yaml:snakeyaml (Maven) Fixed in 1.31 Advisory →

Red Hat 11 advisories

RHSA-2023:3641 Released 2023-06-15 · Red Hat rating Important
Red Hat Integration Camel for Spring Boot 3.18.3 Patch 2 release
- RHINT Camel-Springboot 3.18.3.P2
RHSA-2023:2097 Released 2023-05-03 · Red Hat rating Important
Satellite 6.13 Release
- Red Hat Satellite 6.13 for RHEL 8 ansible-collection-redhat-satellite-3.9.0-2.el8sat, ansible-collection-redhat-satellite_operations-1.3.0-2.el8sat, ansible-lint-5.0.8-4.el8pc +47
RHSA-2023:2100 Released 2023-05-03 · Red Hat rating Important
Red Hat Integration Camel for Spring Boot 3.20.1 security update
- RHINT Camel-Springboot 3.20.1

Show 8 more Red Hat advisories

RHSA-2023:1043 Released 2023-03-01 · Red Hat rating Important
Red Hat Single Sign-On 7.6.2 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
RHSA-2023:1049 Released 2023-03-01 · Red Hat rating Important
Red Hat Single Sign-On 7.6.2 security update
- Red Hat Single Sign-On 7
RHSA-2023:1047 Released 2023-03-01 · Red Hat rating Important
Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
RHSA-2023:1045 Released 2023-03-01 · Red Hat rating Important
Red Hat Single Sign-On 7.6.2 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
RHSA-2023:1044 Released 2023-03-01 · Red Hat rating Important
Red Hat Single Sign-On 7.6.2 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso
RHSA-2022:8876 Released 2022-12-07 · Red Hat rating Moderate
Red Hat AMQ Broker 7.10.2 release and security update
- Red Hat AMQ Broker 7
RHSA-2022:8524 Released 2022-11-17 · Red Hat rating Important
Red Hat Data Grid 8.4.0 security update
- Red Hat Data Grid 8.4.0
RHSA-2022:6757 Released 2022-10-05 · Red Hat rating Important
Red Hat build of Eclipse Vert.x 4.3.3 security update
- Red Hat build of Eclipse Vert.x 4.3.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-09-05
SnakeYAML 1.31
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2022-18261 DoS in SnakeYAMLPriority LOW 33
- TI-2022-18259 DoS in SnakeYAMLPriority LOW 33
Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Developer Tools and Services	Affected	No fix yet
Red Hat A-MQ Online	Affected	No fix planned: Will not fix
Red Hat Decision Manager 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Fuse 7	Affected	No fix planned: Will not fix
Red Hat Integration Camel K 1	Affected	No fix yet
Red Hat Integration Camel Quarkus 1	Affected	No fix yet
Red Hat Integration Service Registry	Affected	No fix planned: Out of support scope
Red Hat JBoss Data Grid 7	Affected	No fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6	Affected	No fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6	Affected	No fix planned: Out of support scope
Red Hat JBoss Fuse 6	Affected	No fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6	Affected	No fix planned: Out of support scope
Red Hat JBoss Operations Network 3	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11	Affected	No fix planned: Out of support scope
Red Hat OpenShift Dev Spaces	Affected	No fix yet
Red Hat Process Automation 7	Affected	No fix planned: Out of support scope
Red Hat Satellite 6	Affected	No fix yet
Red Hat Software Collections	Affected	No fix planned: Will not fix
Red Hat support for Spring Boot	Affected	No fix planned: Will not fix
streams for Apache Kafka	Affected	No fix yet
Middleware Containers for OpenShift	Fixed	RHSA-2023:1047
RHINT Camel-Springboot 3.18.3.P2	Fixed	RHSA-2023:3641
RHINT Camel-Springboot 3.20.1	Fixed	RHSA-2023:2100
Red Hat AMQ Broker 7	Fixed	RHSA-2022:8876
Red Hat Data Grid 8.4.0	Fixed	RHSA-2022:8524
Red Hat Satellite 6.13 for RHEL 8	Fixed	RHSA-2023:2097
Red Hat Single Sign-On 7	Fixed	RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7 Server	Fixed	RHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8	Fixed	RHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9	Fixed	RHSA-2023:1045
Red Hat build of Eclipse Vert.x 4.3.3	Fixed	RHSA-2022:6757

Not affected: 8 products

A-MQ Clients 2
Logging Subsystem for Red Hat OpenShift
Red Hat JBoss Enterprise Application Platform 7
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat Satellite 6.13 for RHEL 8
Red Hat build of Apicurio Registry 2
Red Hat build of Debezium 1
Red Hat build of Quarkus

Timeline

2026-10-02 Threatist record created from CVE-2022-38750
2026-10-03 Alias added: GHSA-hhhw-99gj-p3c3

References

Exploit 2

Advisory 3

Other 3

TI-2022-01345 Remote Code execution in SnakeYAML CVSS 3.1CRITICAL 9.8
TI-2022-18262 DoS in SnakeYAML CVSS 3.1MEDIUM 6.5
TI-2017-13794 The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load… CVSS 3.1HIGH 7.5
TI-2022-09423 Denial of service (DoS) in org.yaml:snakeyaml CVSS 3.1HIGH 7.5
TI-2022-18261 DoS in SnakeYAML CVSS 3.1MEDIUM 6.5
TI-2022-18259 DoS in SnakeYAML CVSS 3.1MEDIUM 6.5

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences