Read the docs
TI-2022-18262 Aliases CVE-2022-38752GHSA-9w3m-gqgf-c4p9

DoS in SnakeYAML

Priority MEDIUM 62CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 15 fixed, 20 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-121 and the CVSS impact.

Summary

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02695 85th percentileScored 2026-11-07
Fix Partial org.yaml:snakeyaml (Maven): 1.32Red Hat: 15 advisoriesRed Hat: 15 fixed, 20 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
snakeyamlSnakeYAMLup to 1.31—No fix listedCNA
—org.yaml:snakeyaml (Maven)before 1.321.32Patch availableGHSA-9w3m-gqgf-c4p9
  • SnakeYAML Vendorsnakeyaml Affected up to 1.31 Fixed in — No fix listed CNA
  • org.yaml:snakeyaml (Maven) Vendor— Affected before 1.32 Fixed in 1.32 Patch available GHSA-9w3m-gqgf-c4p9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*before 1.32Vulnerablesnakeyaml
  • cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:* Versions before 1.32 Vulnerable ·snakeyaml

Remediation

  • Fix · GHSA-9w3m-gqgf-c4p9 org.yaml:snakeyaml (Maven) Fixed in 1.32 Advisory →

Red Hat 15 advisories

  • RHSA-2023:3641 Released 2023-06-15 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.18.3 Patch 2 release
    • RHINT Camel-Springboot 3.18.3.P2
  • RHSA-2023:2710 Released 2023-05-10 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.3 for OpenShift image security update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2023:2713 Released 2023-05-10 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.3 security update
    • Red Hat Single Sign-On 7
Show 12 more Red Hat advisories
  • RHSA-2023:2706 Released 2023-05-10 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.3 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el8sso
  • RHSA-2023:2707 Released 2023-05-10 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.3 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el9sso
  • RHSA-2023:2705 Released 2023-05-10 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.3 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el7sso
  • RHSA-2023:2097 Released 2023-05-03 · Red Hat rating Important
    Satellite 6.13 Release
    • Red Hat Satellite 6.13 for RHEL 8 ansible-collection-redhat-satellite-3.9.0-2.el8sat, ansible-collection-redhat-satellite_operations-1.3.0-2.el8sat, ansible-lint-5.0.8-4.el8pc +47
  • RHSA-2023:2100 Released 2023-05-03 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.20.1 security update
    • RHINT Camel-Springboot 3.20.1
  • RHSA-2023:1516 Released 2023-03-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.10 security update
    • Red Hat JBoss Enterprise Application Platform com.h2database.h2-1.4.197.redhat-00004.jar, io.netty.netty-codec-haproxy-4.1.86.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.23.SP2-redhat-00001.jar +3
  • RHSA-2023:1512 Released 2023-03-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el7eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el7eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el7eap +47
  • RHSA-2023:1513 Released 2023-03-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el8eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el8eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el8eap +47
  • RHSA-2023:1514 Released 2023-03-29 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el9eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el9eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el9eap +47
  • RHSA-2023:0189 Released 2023-01-17 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.3.0 release and security update
    • Red Hat AMQ Streams 2.3.0
  • RHSA-2022:8524 Released 2022-11-17 · Red Hat rating Important
    Red Hat Data Grid 8.4.0 security update
    • Red Hat Data Grid 8.4.0
  • RHSA-2022:6757 Released 2022-10-05 · Red Hat rating Important
    Red Hat build of Eclipse Vert.x 4.3.3 security update
    • Red Hat build of Eclipse Vert.x 4.3.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat AMQ Broker 7AffectedNo fix planned: Will not fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat Integration Service RegistryAffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Satellite 6AffectedNo fix yet
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat support for Spring BootAffectedNo fix planned: Will not fix
Middleware Containers for OpenShiftFixed RHSA-2023:2710
RHINT Camel-Springboot 3.18.3.P2Fixed RHSA-2023:3641
RHINT Camel-Springboot 3.20.1Fixed RHSA-2023:2100
Red Hat AMQ Streams 2.3.0Fixed RHSA-2023:0189
Red Hat Data Grid 8.4.0Fixed RHSA-2022:8524
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:1512
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:1513
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:1514
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2023:1516
Red Hat Satellite 6.13 for RHEL 8Fixed RHSA-2023:2097
Red Hat Single Sign-On 7Fixed RHSA-2023:2713
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2023:2705
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2023:2706
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2023:2707
Red Hat build of Eclipse Vert.x 4.3.3Fixed RHSA-2022:6757
Not affected: 12 products
  • A-MQ Clients 2
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat A-MQ Online
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Satellite 6.13 for RHEL 8
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Debezium 1
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-38752
  2. 2026-10-03 Alias added: GHSA-9w3m-gqgf-c4p9

References

Advisory 3

Other 4

  • TI-2022-01345 Remote Code execution in SnakeYAML CVSS 3.1CRITICAL 9.8
  • TI-2017-13794 The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load… CVSS 3.1HIGH 7.5
  • TI-2022-09423 Denial of service (DoS) in org.yaml:snakeyaml CVSS 3.1HIGH 7.5
  • TI-2022-18261 DoS in SnakeYAML CVSS 3.1MEDIUM 6.5
  • TI-2022-18259 DoS in SnakeYAML CVSS 3.1MEDIUM 6.5
  • TI-2022-20206 Stack Overflow in Snakeyaml CVSS 3.1MEDIUM 6.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences