CVE-2022-38750

DoS in SnakeYAML

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Affected

snakeyaml · SnakeYAML

CVSS v3.1 NVD

5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v3.1 GOOGLE

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

1.25% chance of exploitation in the next 30 days, 69th percentile

Published

2022-09-05

Updated

2024-11-20

Proof-of-concept exploits (1)

• https://bitbucket.org/snakeyaml/snakeyaml/issues/526/stackoverflow-oss-fuzz-47027

Security advisories

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47027
• https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html
• advisories/GHSA-hhhw-99gj-p3c3

References

• CVE Record
• NVD entry