CVE-2022-25857: Uncontrolled Resource Consumption

August 30, 2022 (updated August 8, 2023)

The package org.yaml:snakeyaml from 0 and before 1.31 is vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

References

bitbucket.org/snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174
bitbucket.org/snakeyaml/snakeyaml/issues/525
github.com/snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174
nvd.nist.gov/vuln/detail/CVE-2022-25857
security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360

Code Behaviors & Features

Detect and mitigate CVE-2022-25857 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →