CVE-2022-25857

28

FAUCET Score

CVE-2022-25857 is a Denial of Service (DoS) vulnerability affecting the org.yaml:snakeyaml package versions prior to 1.31, stemming from a missing nested depth limitation for collections. This vulnerability carries a CVSS score of 7.5 (High), indicating it can be exploited remotely with low attack complexity, leading to a complete loss of availability for affected systems, including Debian Linux and various SnakeYAML implementations. While its EPSS score is low and it's not listed in CISA's KEV catalog, there is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), and it has garnered minimal community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 1.31CPE matchmatch criteria	cpe:2.3:a:snakeyaml_project:snakeyaml::::::::
		10.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:10.0:::::::*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

2.19%

Probability of exploitation in next 30 days

EPSS Percentile

80.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0219 is in the 66th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (59)

github_advisorypatch availablevia nvd_reference

mavenpatch availablevia ghsa

Product: org.yaml:snakeyamlFixed in: 1.31

microsoftpatch availablevia msrc

Product: 19652-16823

microsoftpatch availablevia msrc

Product: cbl2 snakeyaml on CBL Mariner 2.0

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.13-RHEL-8Fixed in: jenkins-2-plugins-0:4.13.1698292274-1.el8

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.13-RHEL-8Fixed in: jenkins-2-plugins-0:4.13.1706516346-1.el8

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.14-RHEL-8Fixed in: jenkins-2-plugins-0:4.14.1699356715-1.el8

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.14-RHEL-8Fixed in: jenkins-2-plugins-0:4.14.1706516441-1.el8

redhatpatch availablevia redhat_api

Product: OpenShift Developer Tools and Services for OCP 4.11Fixed in: jenkins-2-plugins-0:4.11.1683009941-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat AMQ Broker 7Fixed in: snakeyaml

redhatpatch availablevia redhat_api

Product: Red Hat build of Eclipse Vert.x 4.3.3Fixed in: snakeyaml

redhatpatch availablevia redhat_api

Product: Red Hat build of Quarkus Platform 2.7.6.SP1Fixed in: snakeyaml

redhatpatch availablevia redhat_api

Product: Red Hat Data Grid 8.4.0Fixed in: snakeyaml

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: prometheus-jmx-exporter-0:0.12.0-8.el8_6

redhatpatch availablevia redhat_api

Product: Red Hat Fuse 7.11.1Fixed in: snakeyaml

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application PlatformFixed in: org.yaml/snakeyaml:1.31.0.redhat-00001

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-activemq-artemis-0:1.5.5.016-1.redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-artemis-native-1:1.5.5.016-1.redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jboss-xnio-base-0:3.5.11-1.Final_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-jsoup-0:1.14.2-1.redhat_00002.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-undertow-0:1.4.18-14.SP13_redhat_00001.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-wildfly-0:7.1.10-2.GA_redhat_00002.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-woodstox-core-0:5.0.3-2.redhat_00002.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Fixed in: eap7-xml-security-0:2.0.10-2.redhat_00002.1.ep7.el7

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-activemq-artemis-0:2.9.0-10.redhat_00021.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-gson-0:2.8.9-1.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-hal-console-0:3.2.18-1.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-server-migration-0:1.7.2-14.Final_redhat_00015.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-jboss-xnio-base-0:3.7.14-3.Final_redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-wildfly-0:7.3.13-4.GA_redhat_00002.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Fixed in: eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Fixed in: eap7-snakeyaml-0:1.31.0-1.redhat_00001.1.el8eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Fixed in: eap7-snakeyaml-0:1.31.0-1.redhat_00001.1.el9eap

redhatpatch availablevia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Fixed in: eap7-snakeyaml-0:1.31.0-1.redhat_00001.1.el7eap

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.10Fixed in: jenkins-2-plugins-0:4.10.1675144701-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.9Fixed in: jenkins-2-plugins-0:4.9.1675668922-1.el8

redhatpatch availablevia redhat_api

Product: Red Hat Satellite 6.13 for RHEL 8Fixed in: candlepin-0:4.2.13-1.el8sat

redhatpatch availablevia redhat_api

Product: Red Hat Single Sign-On 7Fixed in: snakeyaml

redhatpatch availablevia redhat_api

Product: Red Hat Single Sign-On 7.6 for RHEL 7Fixed in: rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso

redhatpatch availablevia redhat_api

Product: Red Hat Single Sign-On 7.6 for RHEL 8Fixed in: rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso

redhatpatch availablevia redhat_api

Product: Red Hat Single Sign-On 7.6 for RHEL 9Fixed in: rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso

redhatpatch availablevia redhat_api

Product: RHEL-8 based Middleware ContainersFixed in: rh-sso-7/sso76-openshift-rhel8:7.6-20

redhatpatch availablevia redhat_api

Product: RHINT Camel-Springboot 3.20.1Fixed in: snakeyaml

redhatpatch availablevia redhat_api

Product: RHINT Service Registry 2.3.0 GAFixed in: snakeyaml

redhatpatch availablevia redhat_api

Product: RHPAM 7.13.4 asyncFixed in: snakeyaml

redhatpatch availablevia redhat_api

Product: RHINT Camel-Springboot 3.18.3.P2Fixed in: snakeyaml

redhatpatch availablevia redhat_api

Product: AMQ ClientsFixed in: snakeyaml

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.12-RHEL-8Fixed in: jenkins-2-plugins-0:4.12.1698294000-1.el8

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.12-RHEL-8Fixed in: jenkins-2-plugins-0:4.12.1706515741-1.el8

redhatno patchvia redhat_api

Product: Red Hat build of QuarkusFixed in: snakeyaml

redhatno patchvia redhat_api

Product: Red Hat Integration Camel K 1Fixed in: snakeyaml

redhatno patchvia redhat_api

Product: Red Hat Integration Camel Quarkus 1Fixed in: snakeyaml

redhatno patchvia redhat_api

Product: Red Hat OpenShift Application RuntimesFixed in: snakeyaml

redhatno patchvia redhat_api

Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/idea-rhel8

redhatno patchvia redhat_api

Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/udi-rhel8

redhatno patchvia redhat_api

Product: Red Hat Satellite 6Fixed in: puppetserver

redhatno patchvia redhat_api

Product: Red Hat support for Spring BootFixed in: snakeyaml

redhatno patchvia redhat_api

Product: streams for Apache KafkaFixed in: snakeyaml

redhatno patchvia redhat_api

Product: A-MQ Clients 2Fixed in: snakeyaml

Vendor Advisories (3)

mavenGHSA-3mc7-4q67-w48mhigh

Uncontrolled Resource Consumption in snakeyaml

redhatCVE-2022-25857Important

snakeyaml: Denial of Service due to missing nested depth limitation for collections

microsoft2022-Aug/CVE-2022-25857Important

Denial of Service (DoS)

References

bitbucket.org / snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174

PatchThird Party Advisory

bitbucket.org / snakeyaml/snakeyaml/issues/525

ExploitIssue TrackingThird Party Advisory

github.com / snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174

PatchThird Party Advisory

lists.debian.org / debian-lts-announce/2022/10/msg00001.html

Mailing ListThird Party Advisory

security.netapp.com / advisory/ntap-20240315-0010

security.snyk.io / vuln/SNYK-JAVA-ORGYAML-2806360

ExploitPatchThird Party Advisory