WaratekVRT Sign in

CVE-2022-1471 SnakeYaml

Affected softwareSnakeYaml
Severity9.8 Critical CVSS 3.1 2 scores
Fixed in2.0
WeaknessDeserialization of untrusted data (CWE-502)
Published1 Dec 2022
Updated11 Nov 2026

Description

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

CWE-20 · Improper input validation

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. Honeypot sightings · 7 exploits · earliest 2026-10-26.
  • CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: no, technical impact: total.
  • Indexed PoC 7 indexed Published artifacts you can open, in GitHub PoC, Metasploit; first seen 2023-03-02.
  • EPSS 99.5% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2022-1471 in VulnCheck (free account), which lists 2 more exploit references not shown here.

EvidenceSourceDetailDate
Honeypot sighting VulnCheck canaries Exploitation attempts seen on 1 day 2026-10-26
Exploit reference VulnCheck XDB 15029c40f290 Exploit type: local 2023-03-02
Exploit reference VulnCheck XDB c346d4447f42 Exploit type: initial-access 2023-05-08
Exploit reference VulnCheck XDB cbb4708feb2c Exploit type: denial-of-service 2026-07-14
Exploit reference VulnCheck XDB 98151186ad44 Exploit type: initial-access 2026-07-17
Exploit reference VulnCheck XDB e724332e57a1 Exploit type: initial-access 2026-07-17

5 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Code for veracode blog 8 2023-03-02
GitHub PoC SnakeYAML-CVE-2022-1471-POC 4 2023-05-08
GitHub PoC SnakeYAML CVE-2022-1471 exploit payload for Seal Security demos 2026-07-17
GitHub PoC Sentinel demo: transitive snakeyaml CVE-2022-1471 via Spring Boot + exploitable code pattern 2026-06-01
GitHub PoC attacker 2026-02-26
GitHub PoC SnakeYAML CVE-2022-1471 exploit payload for demo 2026-02-05
Metasploit PyTorch Model Server Registration and Deserialization RCE (excellent rank)

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2022-1471.armr patch rule, ARMR 2.6 added 2026-11-10 updated 2026-11-11
Sign in to download

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

SnakeYAML Constructor deserialization RCE: a !!javax.script.ScriptEngineManager tag loads the attacker's class over URLClassLoader; Marshal does not hook SnakeYAML, and the ARMR Process rule (with /bin/* and /usr/* listed) stops only payloads that start a program, not ones that take over the running application, such as the published Tomcat Valve or Meterpreter exploits.

How to mitigate CVE-2022-1471

Upgrade SnakeYaml to 2.0 or later. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 8.3 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L cve-coordination@google.com Secondary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2026 ↗ CPU 2026-Q4 Oracle Fusion Middleware / Repository (SnakeYAML) (14.1.2.0.0)
Oracle Critical Patch Update April 2024 ↗ CPU 2024-Q2 Oracle Fusion Middleware / Third Party (SnakeYAML) (12.2.1.4.0)
Oracle Critical Patch Update January 2024 ↗ CPU 2024-Q1 Oracle Communications Applications / PSR Designer (SnakeYAML) (7.4.2.8.0)
Oracle Critical Patch Update October 2023 ↗ CPU 2023-Q4 Oracle Financial Services Applications / Installer (SnakeYAML) (8.1.2.3, 8.1.2.4)
Oracle Financial Services Applications / Securities (SnakeYAML) (11.10, 11.11)
Oracle Financial Services Applications / UI (SnakeYAML) (2.12)
Oracle Financial Services Applications / UI (SnakeYAML) (2.7)
Oracle Financial Services Applications / UI (SnakeYAML) (2.7, 2.12)
Oracle Retail Applications / Xenvironment (SnakeYAML) (22.0.0)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Analytics / Majel Mobile Service (SnakeYAML) (6.4.0.0.0)
Oracle Communications / Core (SnakeYAML) (23.1.0)
Oracle Communications Applications / Common fns (SnakeYAML) (12.0.6.0.0)
Oracle Communications Applications / Common fns (SnakeYAML) (12.0.6.0.0)
Oracle Communications Applications / Platform (SnakeYAML) (12.0.0.4.0-12.0.0.8.0)
Oracle Communications Applications / REST API (SnakeYAML) (12.0.0.4.0-12.0.0.8.0)
Oracle Communications Applications / REST Services Manager (SnakeYAML) (12.0.0.4.0-12.0.0.7.0)
Oracle Financial Services Applications / IDM - Authentication (SnakeYAML) (18.2.0.0.0, 18.3.0.0.0, 19.1.0.0.0, 19.2.0.0.0, 21.1.0.0.0, 22.1.0.0.0, 22.2.0.0.0)
Oracle Financial Services Applications / Infrastructure Code (SnakeYAML) (14.7.0.0.0)
Oracle Financial Services Applications / UI General (SnakeYAML) (18.2.0.0.0, 18.3.0.0.0, 19.1.0.0.0, 19.2.0.0.0, 21.1.0.0.0, 22.1.0.0.0, 22.2.0.0.0)
Oracle Hospitality Applications / Next-Gen SPMS (Helidon) (20.3.3)
Oracle JD Edwards / E1 IOT Orchestrator Security (SnakeYAML) (Prior to 9.2.7.4)
Oracle PeopleSoft / Elastic Search (SnakeYAML) (8.59, 8.60)
Oracle Siebel CRM / EAI (SnakeYAML) (23.4 and prior)
Oracle Utilities Applications / System Wide (SnakeYAML) (2.5.0.2)
Oracle Utilities Applications / Tools (SnakeYAML) (6.0.0.1-7.0.0.0)
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle Communications / Core (SnakeYAML) (9.1.1.4.0)
Oracle Communications Applications / TMF APIs (SnakeYAML) (7.4.1, 7.4.2, 7.5.0)
Oracle Communications Applications / Vision (SnakeYAML) (5.5.0-5.5.10, 6.0.0-6.0.2)
Oracle HealthCare Applications / DataStudio (SnakeYAML) (4.1.0, 4.1.1)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Analytics Majel Mobile Service (SnakeYAML) 6.4.0.0.0 6.4.0.0.0
Oracle Communications Core (SnakeYAML) 9.1.1.4.0 9.1.1.4.0 · 23.1.0
Oracle Communications Applications Common fns (SnakeYAML) 12.0.6.0.0 12.0.6.0.0
Oracle Communications Applications PSR Designer (SnakeYAML) 7.4.2.8.0 7.4.2.8.0
Oracle Communications Applications Platform (SnakeYAML) 12.0.0.4.0-12.0.0.8.0
Oracle Communications Applications REST API (SnakeYAML) 12.0.0.4.0-12.0.0.8.0
Oracle Communications Applications REST Services Manager (SnakeYAML) 12.0.0.4.0-12.0.0.7.0
Oracle Communications Applications TMF APIs (SnakeYAML) 7.4.1, 7.4.2, 7.5.0 7.4.1 · 7.4.2 · 7.5.0
Oracle Communications Applications Vision (SnakeYAML) 5.5.0-5.5.10, 6.0.0-6.0.2
Oracle Financial Services Applications IDM - Authentication (SnakeYAML) 18.2.0.0.0, 18.3.0.0.0, 19.1.0.0.0, 19.2.0.0.0, 21.1.0.0.0, 22.1.0.0.0, 22.2.0.0.0 18.2.0.0.0 · 18.3.0.0.0 · 19.1.0.0.0 · 19.2.0.0.0 · 21.1.0.0.0 · 22.1.0.0.0 · 22.2.0.0.0
Oracle Financial Services Applications Infrastructure Code (SnakeYAML) 14.7.0.0.0 14.7.0.0.0
Oracle Financial Services Applications Installer (SnakeYAML) 8.1.2.3, 8.1.2.4 8.1.2.3 · 8.1.2.4
Oracle Financial Services Applications Securities (SnakeYAML) 11.10, 11.11 11.10 · 11.11
Oracle Financial Services Applications UI (SnakeYAML) 2.7 2.7 · 2.12
Oracle Financial Services Applications UI General (SnakeYAML) 18.2.0.0.0, 18.3.0.0.0, 19.1.0.0.0, 19.2.0.0.0, 21.1.0.0.0, 22.1.0.0.0, 22.2.0.0.0 18.2.0.0.0 · 18.3.0.0.0 · 19.1.0.0.0 · 19.2.0.0.0 · 21.1.0.0.0 · 22.1.0.0.0 · 22.2.0.0.0
Oracle Fusion Middleware Repository (SnakeYAML) 14.1.2.0.0 14.1.2.0.0
Oracle Fusion Middleware Third Party (SnakeYAML) 12.2.1.4.0 12.2.1.4.0
Oracle HealthCare Applications DataStudio (SnakeYAML) 4.1.0, 4.1.1 4.1.0 · 4.1.1
Oracle Hospitality Applications Next-Gen SPMS (Helidon) 20.3.3 20.3.3
Oracle JD Edwards E1 IOT Orchestrator Security (SnakeYAML) Prior to 9.2.7.4
Oracle PeopleSoft Elastic Search (SnakeYAML) 8.59, 8.60 8.59 · 8.60
Oracle Retail Applications Xenvironment (SnakeYAML) 22.0.0 22.0.0
Oracle Siebel CRM EAI (SnakeYAML) 23.4 and prior
Oracle Utilities Applications System Wide (SnakeYAML) 2.5.0.2 2.5.0.2
Oracle Utilities Applications Tools (SnakeYAML) 6.0.0.1-7.0.0.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.yaml:snakeyaml 0 2.0 unbounded

Products and versions

2 products, 2 version entries
SourceVendorProductSchemeAffected versions
osv org.yaml snakeyaml generic ＜ 2.0
nvd snakeyaml project snakeyaml generic ＜ 2.0

References

URLTags
https://access.redhat.com/errata/RHSA-2022:9058 ADVISORY, RHSA-2022:9058
https://access.redhat.com/security/cve/CVE-2022-1471 REPORT, RHSA-2022:9058
https://bugzilla.redhat.com/show_bug.cgi?id=2150009 REPORT, RHSA-2022:9058
https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2 WEB
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true WEB
https://snyk.io/blog/unsafe-deserialization-snakeyaml-java-cve-2022-1471 WEB
https://security.netapp.com/advisory/ntap-20240621-0006 WEB
https://security.netapp.com/advisory/ntap-20230818-0015 WEB
https://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c WEB
https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc WEB

Timeline
Published2022-12-01By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: earliest evidence2026-10-26Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
ARMR remediation created2026-11-10Earliest commit adding this CVE's ARMR patch or security rule.
ARMR remediation last updated2026-11-11Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-11-11Most recent commit touching this CVE's classification, patch or rule file.
Classification created2026-11-13First commit adding this CVE's research note.