CVE-2022-25857

Published: Aug 30, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

Affected (2)

Products: Snakeyaml Project: Snakeyaml · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Snakeyaml Project Snakeyaml	Before 1.31

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Related CWEs

CWE-776

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (12)

https://bitbucket.org/snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174

Source: report@snyk.io

PatchThird Party Advisory

https://bitbucket.org/snakeyaml/snakeyaml/issues/525

Source: report@snyk.io

ExploitIssue TrackingThird Party Advisory

https://github.com/snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174

Source: report@snyk.io

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html

Source: report@snyk.io

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20240315-0010/

Source: report@snyk.io

https://security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360

Source: report@snyk.io

ExploitPatchThird Party Advisory

https://bitbucket.org/snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174