The Snakeyaml Project maintains a YAML parsing library widely embedded in Java applications and frameworks across enterprise and open-source ecosystems, making it a high-impact component despite a narrow product portfolio. Vulnerabilities affecting this library skew toward critical-severity outcomes and frequently acquire public exploit code, reflecting the safety-critical nature of deserialization and input-parsing operations in a JVM-based parsing library. The recurring weakness classes—including out-of-bounds writes, stack-based buffer overflows, XML entity expansion, untrusted deserialization, and input validation gaps—highlight the intersection of YAML parsing complexity and Java object instantiation, where flaws in a single widely embedded library can propagate to downstream applications across a broad deployment base. Current severity and exploitation metrics are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Snakeyaml Project over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-1471CRITICAL SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code | Dec 1, 2022 | 9.8 | 90 | NO | YES |
CVE-2017-18640HIGH The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. | Dec 12, 2019 | 7.5 | 38 | NO | NO |
CVE-2022-25857HIGH The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. | Aug 30, 2022 | 7.5 | 28 | NO | NO |
CVE-2022-41854MEDIUM Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply co | Nov 11, 2022 | 6.5 | 24 | NO | NO |
CVE-2022-38752MEDIUM Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content | Sep 5, 2022 | 6.5 | 24 | NO | NO |
CVE-2022-38751MEDIUM Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content | Sep 5, 2022 | 6.5 | 24 | NO | NO |
CVE-2022-38749MEDIUM Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content | Sep 5, 2022 | 6.5 | 24 | NO | NO |
CVE-2022-38750MEDIUM Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content | Sep 5, 2022 | 5.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Snakeyaml Project.
Media articles that mention a CVE ID that affects a product developed by Snakeyaml Project — matched by CVE ID, not by vendor name.