CVE-2017-18640
SnakeYAML Entity Expansion during load operation
7.5 HighFix available
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
26.7%Up 17.4 points since Apr 14, 2021
What each source reports
NVD Score used
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
- Record
CVE-2017-18640- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-776
- Updated
- 2026-11-02
CVE List No score
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
- Record
CVE-2017-18640- Updated
- 2026-11-02
EUVDEUVD-2021-1404 No score
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
- Record
EUVD-2021-1404- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rvwf-54qp-4r6v
SnakeYAML Entity Expansion during load operation
The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
- Record
GHSA-rvwf-54qp-4r6v- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-776
- Updated
- 2026-11-02
OSV
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
- Record
CVE-2017-18640- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-18640
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
- Record
DEBIAN-CVE-2017-18640- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 17 moreShow less
OSVGHSA-rvwf-54qp-4r6v
SnakeYAML Entity Expansion during load operation
The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
- Record
GHSA-rvwf-54qp-4r6v- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-776
- Updated
- 2026-11-02
OSVRHSA-2020:4807
Red Hat Security Advisory: prometheus-jmx-exporter security update
- Record
RHSA-2020:4807- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVRLSA-2020:4807
Moderate: prometheus-jmx-exporter security update
Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target.
Security Fix(es):
- snakeyaml: Billion laughs attack via alias feature (CVE-2017-18640)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.
- Record
RLSA-2020:4807- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2017-18640
CVE-2017-18640 in org.yaml:snakeyaml - Patched by Root
Root has patched CVE-2017-18640 in the org.yaml:snakeyaml package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2017-18640- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-18640
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
- Record
UBUNTU-CVE-2017-18640- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2020:4807 No score
Moderate: prometheus-jmx-exporter security update
Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target.
Security Fix(es):
- snakeyaml: Billion laughs attack via alias feature (CVE-2017-18640)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2020:4807- Updated
- 2026-11-02
OSVCLSA-2025-1755043490 No score
TuxCare security update for org.yaml:snakeyaml (8 CVEs)
TuxCare rebuilt org.yaml:snakeyaml to address 8 CVEs. Fixed in 1.23.tuxcare.1.
- Record
CLSA-2025-1755043490- Updated
- 2026-11-02
OSVCLSA-2026-1793723663 No score
TuxCare security update for org.yaml:snakeyaml (2 CVEs)
TuxCare rebuilt org.yaml:snakeyaml to address 2 CVEs. Fixed in 1.7-tuxcare.3.
- Record
CLSA-2026-1793723663- Updated
- 2026-11-03
OSVCLSA-2026-1793724671 No score
TuxCare security update for org.yaml:snakeyaml (2 CVEs)
TuxCare rebuilt org.yaml:snakeyaml to address 2 CVEs. Fixed in 1.8-tuxcare.3.
- Record
CLSA-2026-1793724671- Updated
- 2026-11-03
OSVCLSA-2026-1793725044 No score
TuxCare security update for org.yaml:snakeyaml (2 CVEs)
TuxCare rebuilt org.yaml:snakeyaml to address 2 CVEs. Fixed in 1.6-tuxcare.2.
- Record
CLSA-2026-1793725044- Updated
- 2026-11-03
OSVopenSUSE-SU-2021:0855-1 No score
Security update for snakeyaml
This update for snakeyaml fixes the following issues:
- Upgrade to 1.28
- CVE-2017-18640: The Alias feature allows entity expansion during a load operation (bsc#1159488, bsc#1186088)
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:0855-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1876-1 No score
Security update for snakeyaml
This update for snakeyaml fixes the following issues:
- Upgrade to 1.28
- CVE-2017-18640: The Alias feature allows entity expansion during a load operation (bsc#1159488, bsc#1186088)
- Record
openSUSE-SU-2021:1876-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11391-1 No score
snakeyaml-1.28-2.2 on GA media
These are all security issues fixed in the snakeyaml-1.28-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11391-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1876-1 No score
Security update for snakeyaml
This update for snakeyaml fixes the following issues:
- Upgrade to 1.28
- CVE-2017-18640: The Alias feature allows entity expansion during a load operation (bsc#1159488, bsc#1186088)
- Record
SUSE-SU-2021:1876-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1978-1 No score
Security update for snakeyaml
This update for snakeyaml fixes the following issues:
- Upgrade to 1.28
- CVE-2017-18640: The Alias feature allows entity expansion during a load operation (bsc#1159488, bsc#1186088)
- Record
SUSE-SU-2021:1978-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1979-1 No score
Security update for snakeyaml
This update for snakeyaml fixes the following issues:
- Upgrade to 1.28
- CVE-2017-18640: The Alias feature allows entity expansion during a load operation (bsc#1159488, bsc#1186088)
- Record
SUSE-SU-2021:1979-1- Updated
- 2026-11-02
OSVUSN-7368-1 No score
snakeyaml vulnerability
It was discovered that SnakeYAML incorrectly handled recursive entity references. An attacker could possibly use this issue to cause SnakeYAML to crash, resulting in a denial of service.
- Record
USN-7368-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.yaml:snakeyamlMaven |
before 1.26 | 1.26 |
prometheus-jmx-exporterAlmaLinux:8 |
before 0.12.0-6.el8 | 0.12.0-6.el8 |
org.yaml:snakeyamlTuxCare:Maven From an advisory covering 8 CVEs |
1.23 up to 1.23.tuxcare.1 | 1.23.tuxcare.1 |
org.yaml:snakeyamlTuxCare:Maven From an advisory covering 2 CVEs |
1.7 up to 1.7-tuxcare.3, plus listed versions 1.7-tuxcare.11.7-tuxcare.2 |
1.7-tuxcare.3 |
org.yaml:snakeyamlTuxCare:Maven From an advisory covering 2 CVEs |
1.8 up to 1.8-tuxcare.3, plus listed versions 1.8-tuxcare.11.8-tuxcare.2 |
1.8-tuxcare.3 |
org.yaml:snakeyamlTuxCare:Maven From an advisory covering 2 CVEs |
1.6 up to 1.6-tuxcare.2, plus listed versions 1.6-tuxcare.1 |
1.6-tuxcare.2 |
snakeyamlDebian:12 |
before 1.25+ds-3 | 1.25+ds-3 |
snakeyamlDebian:13 |
before 1.25+ds-3 | 1.25+ds-3 |
snakeyamlDebian:14 |
before 1.25+ds-3 | 1.25+ds-3 |
org.yaml:snakeyamlMaven |
before 1.26, plus listed versions 1.101.111.121.131.14 Show 17 moreShow less1.151.161.171.181.191.201.211.221.231.241.251.41.51.61.71.81.9 |
1.26 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
prometheus-jmx-exporterRed Hat:enterprise_linux:8::appstream |
before 0:0.12.0-6.el8 | 0:0.12.0-6.el8 |
prometheus-jmx-exporterRocky Linux:8 |
before 0:0.12.0-6.el8 | 0:0.12.0-6.el8 |
org.yaml:snakeyamlRoot:Maven |
before 1.23-aikido.2 | 1.23-aikido.2 |
io.root.org.yaml:snakeyamlRoot:Maven |
before 1.23-root.io.2 | 1.23-root.io.2 |
snakeyamlSUSE:Linux Enterprise Module for Development Tools 15 SP2 |
before 1.28-3.5.1 | 1.28-3.5.1 |
snakeyamlSUSE:Linux Enterprise Module for Development Tools 15 SP3 |
before 1.28-3.5.1 | 1.28-3.5.1 |
snakeyamlSUSE:Manager Server Module 4.2 |
before 1.28-3.5.1 | 1.28-3.5.1 |
snakeyamlSUSE:Manager Server Module 4.0 |
before 1.28-12.3.1 | 1.28-12.3.1 |
snakeyamlSUSE:Manager Server Module 4.1 |
before 1.28-12.3.1 | 1.28-12.3.1 |
snakeyamlUbuntu:Pro:14.04:LTS |
before 1.12-2ubuntu0.14.04.1~esm2, plus listed versions 1.12-21.12-2ubuntu0.14.04.1~esm1 |
1.12-2ubuntu0.14.04.1~esm2 |
snakeyamlUbuntu:Pro:16.04:LTS |
before 1.12-2ubuntu0.16.04.1~esm2, plus listed versions 1.12-21.12-2ubuntu0.16.04.1~esm1 |
1.12-2ubuntu0.16.04.1~esm2 |
snakeyamlUbuntu:Pro:18.04:LTS |
before 1.23-1+deb10u1ubuntu0.1~esm1, plus listed versions 1.17-11.19-11.20-11.23-1~18.041.23-1+deb10u1build0.18.04.1 |
1.23-1+deb10u1ubuntu0.1~esm1 |
snakeyamlUbuntu:Pro:20.04:LTS |
before 1.25+ds-2ubuntu0.1+esm1, plus listed versions 1.23-11.25+ds-21.25+ds-2ubuntu0.1 |
1.25+ds-2ubuntu0.1+esm1 |
snakeyamlopenSUSE:Leap 15.2 |
before 1.28-lp152.2.3.1 | 1.28-lp152.2.3.1 |
snakeyamlopenSUSE:Leap 15.3 |
before 1.28-3.5.1 | 1.28-3.5.1 |
snakeyamlopenSUSE:Tumbleweed |
before 1.28-2.2 | 1.28-2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-18640 is a high vulnerability (CVSS 7.5) in Snakeyaml Project Snakeyaml, published December 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 26.7%, the 98th percentile. Fixed in org.yaml:snakeyaml 1.26.
References
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKN7VGIKTYBCAKYBRG55QHXAY5UDZ7HA
lists.apache.org/thread.html/r8b57c57cffa01e418868a3c7535b987635ff1fb5ab534203bfa2d64a%40%3Ccommits.pulsar.apache.org%3E
Show 130 moreShow less
oracle.com/security-alerts/cpuApr2021.html
bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion
mvnrepository.com/artifact/org.yaml/snakeyaml/1.25/usages
security.gentoo.org/glsa/202305-28
nvd.nist.gov/vuln/detail/CVE-2017-18640
github.com/advisories/GHSA-rvwf-54qp-4r6v
vulners.com/cve/CVE-2017-18640
security-tracker.debian.org/tracker/CVE-2017-18640
access.redhat.com/errata/RHSA-2020:4807
bugzilla.redhat.com/show_bug.cgi?id=1785376
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4807.json
cve.org/CVERecord?id=CVE-2017-18640
errata.rockylinux.org/RLSA-2020:4807
suse.com/support/update/announcement/2021/suse-su-20211876-1
bugzilla.suse.com/1159488
ubuntu.com/security/CVE-2017-18640
lists.opensuse.org/archives/list/[email protected]/thread/WBPEYN3HS4LO455EQKPMEZAUTFZIRGMT