{
  "cveId": "CVE-2022-41854",
  "url": "https://patchblox.com/security/cve/CVE-2022-41854",
  "summary": "CVE-2022-41854 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2022-41854, released November 11, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "snakeyaml: Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS)",
  "description": "Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.",
  "published": "2022-11-11T13:15:11Z",
  "severity": "medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
  "epss": 0.01555,
  "epssPercentile": 0.75318,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "snakeyaml",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1.33-1",
      "fix": "DEBIAN-CVE-2022-41854",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-41854",
      "released": "2022-11-11T13:15:11Z"
    },
    {
      "platform": "linux",
      "product": "snakeyaml",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.33-1",
      "fix": "DEBIAN-CVE-2022-41854",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-41854",
      "released": "2022-11-11T13:15:11Z"
    },
    {
      "platform": "linux",
      "product": "snakeyaml",
      "release": "Debian 14",
      "fixedVersion": "1.33-1",
      "fix": "DEBIAN-CVE-2022-41854",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-41854",
      "released": "2022-11-11T13:15:11Z"
    },
    {
      "platform": "linux",
      "product": "snakeyaml",
      "release": "amzn 2023",
      "fixedVersion": "1.27-6.amzn2023.0.3",
      "fix": "ALAS2023-2023-375",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-375",
      "released": "2023-09-27T21:07:00Z"
    },
    {
      "platform": "linux",
      "product": "snakeyaml-javadoc",
      "release": "amzn 2023",
      "fixedVersion": "1.27-6.amzn2023.0.3",
      "fix": "ALAS2023-2023-375",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-375",
      "released": "2023-09-27T21:07:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}