{
  "cveId": "CVE-2022-38749",
  "url": "https://patchblox.com/security/cve/CVE-2022-38749",
  "summary": "CVE-2022-38749 is fixed in 2 products on 1 platform, first by libyaml-snake-java 1.23-1\u002Bdeb10u1build0.18.04.1, released September 5, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libyaml-snake-java: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS)",
  "description": "Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.",
  "published": "2022-09-05T03:15:00Z",
  "severity": "Medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.02199,
  "epssPercentile": 0.82611,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libyaml-snake-java",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.23-1\u002Bdeb10u1build0.18.04.1",
      "fix": "libyaml-snake-java 1.23-1\u002Bdeb10u1build0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libyaml-snake-java-1.23-1-deb10u1build0.18.04.1",
      "released": "2022-09-05T03:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libyaml-snake-java",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.25\u002Bds-2ubuntu0.1",
      "fix": "libyaml-snake-java 1.25\u002Bds-2ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libyaml-snake-java-1.25-ds-2ubuntu0.1",
      "released": "2022-09-05T03:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libyaml-snake-java",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.29-1ubuntu0.22.04.1",
      "fix": "libyaml-snake-java 1.29-1ubuntu0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libyaml-snake-java-1.29-1ubuntu0.22.04.1",
      "released": "2022-09-05T03:15:00Z"
    },
    {
      "platform": "linux",
      "product": "snakeyaml",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1.31-1",
      "fix": "DEBIAN-CVE-2022-38749",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-38749",
      "released": "2022-09-05T10:15:09Z"
    },
    {
      "platform": "linux",
      "product": "snakeyaml",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.31-1",
      "fix": "DEBIAN-CVE-2022-38749",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-38749",
      "released": "2022-09-05T10:15:09Z"
    },
    {
      "platform": "linux",
      "product": "snakeyaml",
      "release": "Debian 14",
      "fixedVersion": "1.31-1",
      "fix": "DEBIAN-CVE-2022-38749",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-38749",
      "released": "2022-09-05T10:15:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}