CVE-2023-24620

CVE-2023-24620 is a medium-severity vulnerability affecting Esoteric YamlBeans through version 1.15, allowing for an XML Entity Expansion attack. A specially crafted YAML document can exploit the Anchor feature to expand into a large size, leading to high CPU and memory consumption, potentially causing a Java Out-of-Memory exception. The attack requires local access or user interaction (UI:R), has low attack complexity, and primarily impacts availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.