Description
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a org.yaml:snakeyaml
0 to < unspecifiedaffectedunspecified to < 1.31affected
References
- https://security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360 ↗
- https://bitbucket.org/snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174 ↗
- https://github.com/snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174 ↗
- https://bitbucket.org/snakeyaml/snakeyaml/issues/525 ↗
- https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html ↗
- https://security.netapp.com/advisory/ntap-20240315-0010/ ↗