{"id":"CVE-2022-38750","summary":"DoS in SnakeYAML","details":"Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.","aliases":["GHSA-hhhw-99gj-p3c3"],"modified":"2026-10-28T02:30:42.230641302Z","published":"2022-09-05T00:00:00Z","related":["SUSE-SU-2022:3397-1","SUSE-SU-2022:3560-1","openSUSE-SU-2024:12308-1"],"database_specific":{"cna_assigner":"Google","cwe_ids":["CWE-121"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38750.json"},"references":[{"type":"WEB","url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/526/stackoverflow-oss-fuzz-47027"},{"type":"WEB","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47027"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38750.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38750"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202305-28"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20240315-0010/"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://bitbucket.org/snakeyaml/snakeyaml","events":[{"introduced":"0"},{"fixed":"04401a88fa9b36f555cdc91f72ca1e724090c031"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"1.31"}],"source":"AFFECTED_FIELD","strategy":"SplitRange"},{"cpe":"cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"1.31"}],"source":"CPE_RANGE"}]}}],"versions":["snakeyaml-1.30","snakeyaml-1.27","snakeyaml-1.26","snakeyaml-1.25","snakeyaml-1.24","snakeyaml-1.23","snakeyaml-1.22","snakeyaml-1.21","snakeyaml-1.20","snakeyaml-1.19","v1.18","v1.17","v1.16","v1.15","v1.13","v1.12","v1.11","v1.10","v1.9","v1.8","v1.7","v1.7rc1","v1.6","1.6rc2","v1.6rc1","v1.5","v1.5rc1","v1.4rc1","v1.3","v1.2","v1.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-38750.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}