WaratekVRT Sign in

CVE-2022-25857 snakeyaml

Affected softwaresnakeyaml
Severity7.5 High CVSS 3.1 2 scores
Fixed in1.31
WeaknessXML entity expansion (CWE-776)
Published30 Aug 2022
Updated17 Jun 2026

Description

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

CWE-400 · Uncontrolled resource consumption

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 4 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 2.9% chance in 30 days

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available security rule
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Protected by Waratek.

How to mitigate CVE-2022-25857

Upgrade snakeyaml to 1.31 or later. Until you can, Waratek RASP blocks exploitation with a security rule that blocks this kind of attack. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H report@snyk.io Secondary published
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle JD Edwards / E1 IOT Orchestrator Security (jruby) (Prior to 9.2.7.3)
Oracle Critical Patch Update January 2023 ↗ CPU 2023-Q1 Oracle Communications / Signaling (SnakeYAML) (22.2.2)
Oracle Communications Applications / REST Services Manager (SnakeYaml) (12.0.0.4.0-12.0.0.7.0)
Oracle PeopleSoft / Cloud Manager (SnakeYAML) (8.58, 8.59, 8.60)
Oracle Critical Patch Update October 2022 ↗ CPU 2022-Q4 Oracle Communications / Installer (SnakeYAML) (22.2.0)
Oracle Communications / Platform (SnakeYAML) (22.3.0)
Oracle Communications / Security (SnakeYAML) (22.2.1,22.3.0)
Oracle Communications / Signaling (SnakeYAML) (22.2.3, 22.3.1, 22.4.0)
Oracle Communications / Signaling (SnakeYAML) (22.3.0)
Oracle Communications Applications / REST Service Manager (SnakeYAML) (12.0.0.5.0-12.0.0.7.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Installer (SnakeYAML) 22.2.0 22.2.0
Oracle Communications Platform (SnakeYAML) 22.3.0 22.3.0
Oracle Communications Security (SnakeYAML) 22.2.1,22.3.0 22.2.1 · 22.3.0
Oracle Communications Signaling (SnakeYAML) 22.2.2 22.2.2 · 22.2.3 · 22.3.0 · 22.3.1 · 22.4.0
Oracle Communications Applications REST Service Manager (SnakeYAML) 12.0.0.5.0-12.0.0.7.0
Oracle Communications Applications REST Services Manager (SnakeYaml) 12.0.0.4.0-12.0.0.7.0
Oracle JD Edwards E1 IOT Orchestrator Security (jruby) Prior to 9.2.7.3
Oracle PeopleSoft Cloud Manager (SnakeYAML) 8.58, 8.59, 8.60 8.58 · 8.59 · 8.60

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.yaml:snakeyaml 0 1.31 unbounded

Products and versions

3 products, 3 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 10.0
osv org.yaml snakeyaml generic ＜ 1.31
nvd snakeyaml project snakeyaml generic ＜ 1.31

References

URLTags
https://access.redhat.com/errata/RHSA-2022:6820 ADVISORY, RHSA-2022:6820
https://bugzilla.redhat.com/show_bug.cgi?id=2126789 REPORT, RHSA-2022:6820
https://access.redhat.com/security/cve/CVE-2022-25857 REPORT, RHSA-2022:6820
https://github.com/snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174 WEB
https://bitbucket.org/snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174 WEB
https://bitbucket.org/snakeyaml/snakeyaml/issues/525 WEB
https://github.com/snakeyaml/snakeyaml PACKAGE
https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html WEB
https://security.netapp.com/advisory/ntap-20240315-0010 WEB
https://security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360 WEB

Timeline
Published2022-08-30By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.