Stack Overflow in Snakeyaml
Priority LOW 32CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 18 fixed, 20 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-121 and the CVSS impact.
Summary
Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.
Why it matters now
EPSS 0.01555 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial SnakeYaml (SnakeYaml): 1.32org.yaml:snakeyaml (Maven): 1.32Red Hat: 17 advisoriesRed Hat: 18 fixed, 20 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| snakeyaml | SnakeYaml | before 1.32 | 1.32 | Patch available | CNA |
| — | org.yaml:snakeyaml (Maven) | before 1.32 | 1.32 | Patch available | GHSA-w37g-rhq8-7m4j |
- SnakeYaml Vendorsnakeyaml Affected before 1.32 Fixed in 1.32 Patch available CNA
- org.yaml:snakeyaml (Maven) Vendor— Affected before 1.32 Fixed in 1.32 Patch available GHSA-w37g-rhq8-7m4j
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:* | before 1.32 | Vulnerable | snakeyaml |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
- cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:* Versions before 1.32 Vulnerable ·snakeyaml
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA SnakeYaml (SnakeYaml) Fixed in 1.32
- Fix · GHSA-w37g-rhq8-7m4j org.yaml:snakeyaml (Maven) Fixed in 1.32 Advisory →
Red Hat 17 advisories
- RHSA-2023:7697 Released 2023-12-07 · Red Hat rating ModerateAMQ Clients 2023.Q4
- Red Hat AMQ Clients
- RHSA-2023:4983 Released 2023-09-05 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.4 security update
- RHPAM 7.13.4 async
- RHSA-2023:4627 Released 2023-08-14 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-ui-rhel9 +1
Show 14 more Red Hat advisories
- RHSA-2023:3954 Released 2023-06-29 · Red Hat rating CriticalRed Hat Fuse 7.12 release and security update
- Red Hat Fuse 7.12
- RHSA-2023:3641 Released 2023-06-15 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.18.3 Patch 2 release
- RHINT Camel-Springboot 3.18.3.P2
- RHSA-2023:3373 Released 2023-05-31 · Red Hat rating ModerateMigration Toolkit for Runtimes security update
- Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-web-container-rhel8
- RHSA-2023:2710 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 for OpenShift image security update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2023:2713 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 security update
- Red Hat Single Sign-On 7
- RHSA-2023:2706 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el8sso
- RHSA-2023:2707 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el9sso
- RHSA-2023:2705 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el7sso
- RHSA-2023:2100 Released 2023-05-03 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.20.1 security update
- RHINT Camel-Springboot 3.20.1
- RHSA-2023:1516 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 security update
- Red Hat JBoss Enterprise Application Platform com.h2database.h2-1.4.197.redhat-00004.jar, io.netty.netty-codec-haproxy-4.1.86.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.23.SP2-redhat-00001.jar +3
- RHSA-2023:1512 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el7eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el7eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el7eap +47
- RHSA-2023:1513 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el8eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el8eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el8eap +47
- RHSA-2023:1514 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el9eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el9eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el9eap +47
- RHSA-2023:0577 Released 2023-02-16 · Red Hat rating ModerateRed Hat build of Eclipse Vert.x 4.3.7 security update
- Red Hat build of Eclipse Vert.x 4.3.7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| A-MQ Clients 2 | Affected | No fix yet |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat build of Debezium 1 | Affected | No fix planned: Will not fix |
| Red Hat support for Spring Boot | Affected | No fix yet |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2023:4627 |
| Middleware Containers for OpenShift | Fixed | RHSA-2023:2710 |
| Migration Toolkit for Runtimes 1 on RHEL 8 | Fixed | RHSA-2023:3373 |
| OpenShift Developer Tools and Services for OCP 4.12 | Fixed | — |
| RHINT Camel-Springboot 3.18.3.P2 | Fixed | RHSA-2023:3641 |
| RHINT Camel-Springboot 3.20.1 | Fixed | RHSA-2023:2100 |
| RHPAM 7.13.4 async | Fixed | RHSA-2023:4983 |
| Red Hat AMQ Clients | Fixed | RHSA-2023:7697 |
| Red Hat Fuse 7.12 | Fixed | RHSA-2023:3954 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2023:1512 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2023:1513 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2023:1514 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2023:1516 |
| Red Hat Single Sign-On 7 | Fixed | RHSA-2023:2713 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2023:2705 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2023:2706 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2023:2707 |
| Red Hat build of Eclipse Vert.x 4.3.7 | Fixed | RHSA-2023:0577 |
Not affected: 14 products
- Logging Subsystem for Red Hat OpenShift
- MTA 6.2 for RHEL 8
- Migration Toolkit for Runtimes 1 on RHEL 8
- Red Hat A-MQ Online
- Red Hat AMQ Broker 7
- Red Hat Data Grid 8
- Red Hat Integration Camel Quarkus 1
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform
- Red Hat Satellite 6
- Red Hat build of Apicurio Registry 2
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2022-41854
- 2026-10-03 Alias added: GHSA-w37g-rhq8-7m4j
References
Advisory 4
Other 13
- https://security.netapp.com/advisory/ntap-20240315-0009/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://bitbucket.org/snakeyaml/snakeyaml
- https://bitbucket.org/snakeyaml/snakeyaml/commits/e230a1758842beec93d28eddfde568c21774780a
- https://bitbucket.org/snakeyaml/snakeyaml/issues/531
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DDXEXXWAZGF5AVHIPGFPXIWL6TSMKJE
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7MKE4XWRXTH32757H7QJU4ACS67DYDCR
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSPAJ5Y45A4ZDION2KN5RDWLHK4XKY2J
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3DDXEXXWAZGF5AVHIPGFPXIWL6TSMKJE
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7MKE4XWRXTH32757H7QJU4ACS67DYDCR
- https://lists.fedoraproject.org/archives/list/[email protected]/message/KSPAJ5Y45A4ZDION2KN5RDWLHK4XKY2J
- https://security.netapp.com/advisory/ntap-20240315-0009
- https://security.netapp.com/advisory/ntap-20240621-0006
More Snakeyaml vulnerabilities
- TI-2022-01345 Remote Code execution in SnakeYAML CVSS 3.1CRITICAL 9.8
- TI-2022-18262 DoS in SnakeYAML CVSS 3.1MEDIUM 6.5
- TI-2017-13794 The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load… CVSS 3.1HIGH 7.5
- TI-2022-09423 Denial of service (DoS) in org.yaml:snakeyaml CVSS 3.1HIGH 7.5
- TI-2022-18261 DoS in SnakeYAML CVSS 3.1MEDIUM 6.5
- TI-2022-18259 DoS in SnakeYAML CVSS 3.1MEDIUM 6.5
Sources
- CVE-2022-41854 · CVE Program
- CVE-2022-41854 · NVD
- FIRST EPSS
- GHSA-w37g-rhq8-7m4j · GitHub Advisory Database · CC BY 4.0
- CVE-2022-41854 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences