CVE-2022-38749: DoS in SnakeYAML
A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash, resulting in a denial of service.
Other sources
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-38749?
CVE-2022-38749 is a vulnerability in the snakeyaml package that allows for Denial of Service (DOS) attacks through the parsing of specially-crafted YAML files.
How severe is CVE-2022-38749?
CVE-2022-38749 has a severity rating of 6.5 out of 10, making it a medium severity vulnerability.
Which software versions are affected by CVE-2022-38749?
Versions up to but not including 1.31.0 of the snakeyaml package are affected by CVE-2022-38749.
How can I fix CVE-2022-38749?
To fix CVE-2022-38749, you should update your snakeyaml package to version 1.31.0 or later.
Where can I find more information about CVE-2022-38749?
You can find more information about CVE-2022-38749 on the CVE website (https://www.cve.org/CVERecord?id=CVE-2022-38749) and the NIST National Vulnerability Database (https://nvd.nist.gov/vuln/detail/CVE-2022-38749).