CVE-2022-38749: DoS in SnakeYAML

Published Sep 5, 2022
·
Updated

A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash, resulting in a denial of service.

Other sources

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Affected Software

16 affected componentsFixes available
redhat/candlepin<0:4.2.13-1.el8
0:4.2.13-1.el8
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el7
0:18.0.6-1.redhat_00001.1.el7
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el8
0:18.0.6-1.redhat_00001.1.el8
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el9
0:18.0.6-1.redhat_00001.1.el9
redhat/snakeyaml<1.31.0
1.31.0
maven/pl.droidsonroids.yaml:snakeyaml<=1.18.2
maven/org.testifyproject.external:external-snakeyaml<=1.0.6
maven/io.prometheus.jmx:jmx_prometheus_httpserver_java6<=0.18.0
maven/io.prometheus.jmx:jmx_prometheus_httpserver=0.17.0
maven/com.alipay.sofa.acts:acts-common-util=1.0.0
maven/be.cylab:snakeyaml=1.25.1
maven/org.yaml:snakeyaml<1.31
1.31
Snakeyaml Project Snakeyaml<1.31
Debian Debian Linux=10.0
Microsoft cbl2 snakeyaml
IBM watsonx.data intelligence<=5.2.0, 5.2.1, 5.3.0, 5.3.1

Event History

Sep 5, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Sep 6, 2022
Advisory Published
via GitHub·12:00 AM
Oct 1, 2025
Data Sourced
via Microsoft·11:11 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·11:11 PM
Affected Software
Updated
via Microsoft·11:11 PM
DescriptionSeverity
Apr 27, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2022-38749?

CVE-2022-38749 is a vulnerability in the snakeyaml package that allows for Denial of Service (DOS) attacks through the parsing of specially-crafted YAML files.

2

How severe is CVE-2022-38749?

CVE-2022-38749 has a severity rating of 6.5 out of 10, making it a medium severity vulnerability.

3

Which software versions are affected by CVE-2022-38749?

Versions up to but not including 1.31.0 of the snakeyaml package are affected by CVE-2022-38749.

4

How can I fix CVE-2022-38749?

To fix CVE-2022-38749, you should update your snakeyaml package to version 1.31.0 or later.

5

Where can I find more information about CVE-2022-38749?

You can find more information about CVE-2022-38749 on the CVE website (https://www.cve.org/CVERecord?id=CVE-2022-38749) and the NIST National Vulnerability Database (https://nvd.nist.gov/vuln/detail/CVE-2022-38749).

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203