CVE-2019-6292 describes a stack exhaustion vulnerability in yaml-cpp (aka LibYaml-C++) version 0.6.2, specifically within the singledocparser.cpp file. This flaw, caused by recursive stack frames in various handling functions, allows remote attackers to trigger a denial-of-service condition via a specially crafted YAML file. The vulnerability has a CVSS score of 6.5 (Medium), indicating it can be exploited over a network with low attack complexity, requiring user interaction, and leading to high availability impact. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.6.2CPE matchmatch criteria | cpe:2.3:a:yaml-cpp_project:yaml-cpp:0.6.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
An issue was discovered in singledocparser.cpp in yaml-cpp (aka LibYaml-C++) 0.6.2. Stack Exhaustion occurs in YAML::SingleDocParser and there is a stack consumption problem caused by recursive stack frames: HandleCompactMap HandleMap HandleFlowSequence HandleSequence HandleNode. Remote attackers could leverage this vulnerability to cause a denial-of-service via a cpp file.
Jan 8, 2019yaml-cpp: DoS in singledocparser.cpp
Jan 2, 2019