{"id":"CVE-2017-18640","aliases":["ALSA-2020:4807","CLSA-2025-1755043490","CLSA-2026-1793723663","CLSA-2026-1793724671","CLSA-2026-1793725044","DEBIAN-CVE-2017-18640","EUVD-2021-1404","GHSA-rvwf-54qp-4r6v","RHSA-2020:4807","RLSA-2020:4807","ROOT-APP-MAVEN-CVE-2017-18640","SUSE-SU-2021:1876-1","SUSE-SU-2021:1978-1","SUSE-SU-2021:1979-1","UBUNTU-CVE-2017-18640","USN-7368-1","openSUSE-SU-2021:0855-1","openSUSE-SU-2021:1876-1","openSUSE-SU-2024:11391-1"],"status":"published","title":"SnakeYAML Entity Expansion during load operation","description":"The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.26723,"percentile":0.98038,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-776"],"published":"2019-12-12T00:00:00Z","modified":"2026-11-03T19:30:08Z","fixes":[{"ecosystem":"Maven","package":"org.yaml:snakeyaml","fixed_in":["1.26"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:8","package":"prometheus-jmx-exporter","fixed_in":["0.12.0-6.el8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"snakeyaml","fixed_in":["1.25+ds-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"snakeyaml","fixed_in":["1.25+ds-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"snakeyaml","fixed_in":["1.25+ds-3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"prometheus-jmx-exporter","fixed_in":["0:0.12.0-6.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"prometheus-jmx-exporter","fixed_in":["0:0.12.0-6.el8"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.yaml:snakeyaml","fixed_in":["1.23-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.yaml:snakeyaml","fixed_in":["1.23-root.io.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"snakeyaml","fixed_in":["1.28-3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"snakeyaml","fixed_in":["1.28-3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.2","package":"snakeyaml","fixed_in":["1.28-3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.0","package":"snakeyaml","fixed_in":["1.28-12.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server Module 4.1","package":"snakeyaml","fixed_in":["1.28-12.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"snakeyaml","fixed_in":["1.12-2ubuntu0.14.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"snakeyaml","fixed_in":["1.12-2ubuntu0.16.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"snakeyaml","fixed_in":["1.23-1+deb10u1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"snakeyaml","fixed_in":["1.25+ds-2ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"snakeyaml","fixed_in":["1.28-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"snakeyaml","fixed_in":["1.28-3.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"snakeyaml","fixed_in":["1.28-2.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.yaml:snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"prometheus-jmx-exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-6.el8"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.yaml:snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.23"},{"fixed":"1.23.tuxcare.1"}]}],"versions":["1.23"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.yaml:snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7"},{"fixed":"1.7-tuxcare.3"}]}],"versions":["1.7","1.7-tuxcare.1","1.7-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.yaml:snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8"},{"fixed":"1.8-tuxcare.3"}]}],"versions":["1.8","1.8-tuxcare.1","1.8-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.yaml:snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6"},{"fixed":"1.6-tuxcare.2"}]}],"versions":["1.6","1.6-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25+ds-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25+ds-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25+ds-3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.yaml:snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26"}]}],"versions":["1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.19","1.20","1.21","1.22","1.23","1.24","1.25","1.4","1.5","1.6","1.7","1.8","1.9"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"prometheus-jmx-exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-6.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"prometheus-jmx-exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-6.el8"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.yaml:snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.yaml:snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23-root.io.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-12.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-12.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-2ubuntu0.14.04.1~esm2"}]}],"versions":["1.12-2","1.12-2ubuntu0.14.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-2ubuntu0.16.04.1~esm2"}]}],"versions":["1.12-2","1.12-2ubuntu0.16.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23-1+deb10u1ubuntu0.1~esm1"}]}],"versions":["1.17-1","1.19-1","1.20-1","1.23-1~18.04","1.23-1+deb10u1build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25+ds-2ubuntu0.1+esm1"}]}],"versions":["1.23-1","1.25+ds-2","1.25+ds-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-2ubuntu0.14.04.1~esm2"}]}],"versions":["1.12-2","1.12-2ubuntu0.14.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-2ubuntu0.16.04.1~esm2"}]}],"versions":["1.12-2","1.12-2ubuntu0.16.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23-1+deb10u1ubuntu0.1~esm1"}]}],"versions":["1.17-1","1.19-1","1.20-1","1.23-1~18.04","1.23-1+deb10u1build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25+ds-2ubuntu0.1+esm1"}]}],"versions":["1.23-1","1.25+ds-2","1.25+ds-2ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-3.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.2"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"peoplesoft_enterprise_pt_peopletools"},{"vendor":"quarkus","product":"quarkus"},{"vendor":"snakeyaml_project","product":"snakeyaml"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKN7VGIKTYBCAKYBRG55QHXAY5UDZ7HA/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTVJC54XGX26UJVVYCXZ7D25X3R5T2G6/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r8b57c57cffa01e418868a3c7535b987635ff1fb5ab534203bfa2d64a%40%3Ccommits.pulsar.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb34d8d3269ad47a1400f5a1a2d8310e13a80b6576ebd7f512144198d%40%3Ccommon-dev.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r8464b6ec951aace8c807bac9ea526d4f9e3116aa16d38be06f7c6524%40%3Ccommon-issues.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r643ba53f002ae59068f9352fe1d82e1b6f375387ffb776f13efe8fda%40%3Ccommon-issues.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r2b05744c0c2867daa5d1a96832965b7d6220328b0ead06c22a6e7854%40%3Ccommits.pulsar.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r6c91e52b3cc9f4e64afe0f34f20507143fd1f756d12681a56a9b38da%40%3Ccommits.pulsar.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r72a3588d62b2de1361dc9648f5d355385735e47f7ba49d089b0e680d%40%3Ccommon-issues.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1dfac8b6a7097bcb4979402bbb6e2f8c36d0d9001e3018717eb22b7e%40%3Cdev.atlas.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb0e033d5ec8233360203431ad96580cf2ec56f47d9a425d894e279c2%40%3Cpr.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r2a5b84fdf59042dc398497e914b5bb1aed77328320b1438144ae1953%40%3Cdev.atlas.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r6d54c2da792c74cc14b9b7665ea89e144c9e238ed478d37fd56292e6%40%3Cdev.atlas.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r666f29a7d0e1f98fa1425ca01efcfa86e6e3856e01d300828aa7c6ea%40%3Ccommits.pulsar.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r154090b871cf96d985b90864442d84eb027c72c94bc3f0a5727ba2d1%40%3Ccommon-issues.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r28c9009a48d52cf448f8b02cd823da0f8601d2dff4d66f387a35f1e0%40%3Cdev.atlas.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb7b28ac741e32dd5edb2c22485d635275bead7290b056ee56baf8ce0%40%3Cdev.atlas.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re791a854001ec1f79cd4f47328b270e7a1d9d7056debb8f16d962722%40%3Cdev.atlas.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rce5c93bba6e815fb62ad38e28ca1943b3019af1eddeb06507ad4e11a%40%3Ccommits.atlas.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r5510f0125ba409fc1cabd098ab8b457741e5fa314cbd0e61e4339422%40%3Cdev.atlas.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r2db207a2431a5e9e95e899858ab1f5eabd9bcc790a6ca7193ae07e94%40%3Cdev.atlas.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1058e7646988394de6a3fd0857ea9b1ee0de14d7bb28fee5ff782457%40%3Ccommits.atlas.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re851bbfbedd47c690b6e01942acb98ee08bd00df1a94910b905bc8cd%40%3Cdev.atlas.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r56805265475919252ba7fc10123f15b91097f3009bae86476624ca25%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rbaa1f513d903c89a08267c91d86811fa5bcc82e0596b6142c5cea7ea%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/reb1751562ee5146d3aca654a2df76a2c13d8036645ce69946f9c219e%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1ffce2ed3017e9964f03ad2c539d69e49144fc8e9bf772d641612f98%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc3211c71f7e0973a1825d1988a3921288c06cd9d793eae97ecd34948%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r55d807f31e64a080c54455897c20b1667ec792e5915132c7b7750533%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/recfe569f4f260328b0036f1c82b2956e864d519ab941a5e75d0d832d%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf95bebee6dfcc55067cebe8482bd31e6f481d9f74ba8e03f860c3ec7%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1703a402f30c8a2ee409f8c6f393e95a63f8c952cc9ee5bf9dd586dc%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r191ceadb1b883357384981848dfa5235cb02a90070c553afbaf9b3d9%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r20350031c60a77b45e0eded33e9b3e9cb0cbfc5e24e1c63bf264df12%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd582c64f66c354240290072f340505f5d026ca944ec417226bb0272e%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb5c33d0069c927fae16084f0605895b98d231d7c48527bcb822ac48c%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rcb4b61dbe2ed1c7a88781a9aff5a9e7342cc7ed026aec0418ee67596%40%3Ccommon-issues.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/raebd2019b3da8c2f90f31e8b203b45353f78770ca93bfe5376f5532e%40%3Ccommon-issues.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r4d7f37da1bc2df90a5a0f56eb7629b5ea131bfe11eeeb4b4c193f64a%40%3Ccommon-issues.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r22ac2aa053b7d9c6b75a49db78125c9316499668d0f4a044f3402e2f%40%3Ccommon-issues.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1aab47b48a757c70e40fc0bcb1fcf1a3951afa6a17aee7cd66cf79f8%40%3Ccommon-commits.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rcb2a7037366c58bac6aec6ce3df843a11ef97ae4eb049f05f410eaa5%40%3Ccommon-commits.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r436988d2cfe8a770ae361c82b181c5b2bf48a249bad84d8a55a3b46e%40%3Cdev.phoenix.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r7ce3de03facf7e7f3e24fc25d26d555818519dafdb20f29398a3414b%40%3Cdev.phoenix.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://mvnrepository.com/artifact/org.yaml/snakeyaml/1.25/usages","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://bitbucket.org/asomov/snakeyaml/wiki/Billion%20laughs%20attack","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r4c682fb8cf69dd14162439656a6ebdf42ea6ad0e4edba95907ea3f14%40%3Ccommits.servicecomb.apache.org%3E","tags":["x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r900e020760c89f082df1c6e0d46320eba721e4e47bb9eb521e68cd95%40%3Ccommits.servicecomb.apache.org%3E","tags":["x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r16ae4e529401b75a1f5aa462b272b31bf2a108236f882f06fddc14bc%40%3Ccommon-issues.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rfe0aab6c3bebbd9cbfdedb65ff3fdf420714bcb8acdfd346077e1263%40%3Ccommon-commits.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r182e9cf6f3fb22b9be0cac4ff0685199741d2ab6e9a4e27a3693c224%40%3Ccommon-issues.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rdd34c0479587e32a656d976649409487d51ca0d296b3e26b6b89c3f5%40%3Ccommon-commits.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r465d2553a31265b042cf5457ef649b71e0722ab89b6ea94a5d59529b%40%3Ccommon-issues.hadoop.apache.org%3E","tags":["mailing-list","x_transferred","web"]},{"url":"https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes","tags":["x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/377","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://security.gentoo.org/glsa/202305-28","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18640","tags":["advisory"]},{"url":"https://bitbucket.org/asomov/snakeyaml/commits/da11ddbd91c1f8392ea932b37fa48110fa54ed8c","tags":["web"]},{"url":"https://bitbucket.org/asomov/snakeyaml/wiki/Changes","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r1058e7646988394de6a3fd0857ea9b1ee0de14d7bb28fee5ff782457@%3Ccommits.atlas.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r154090b871cf96d985b90864442d84eb027c72c94bc3f0a5727ba2d1@%3Ccommon-issues.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r1703a402f30c8a2ee409f8c6f393e95a63f8c952cc9ee5bf9dd586dc@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r191ceadb1b883357384981848dfa5235cb02a90070c553afbaf9b3d9@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r1aab47b48a757c70e40fc0bcb1fcf1a3951afa6a17aee7cd66cf79f8@%3Ccommon-commits.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r1dfac8b6a7097bcb4979402bbb6e2f8c36d0d9001e3018717eb22b7e@%3Cdev.atlas.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r1ffce2ed3017e9964f03ad2c539d69e49144fc8e9bf772d641612f98@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r20350031c60a77b45e0eded33e9b3e9cb0cbfc5e24e1c63bf264df12@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r22ac2aa053b7d9c6b75a49db78125c9316499668d0f4a044f3402e2f@%3Ccommon-issues.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r28c9009a48d52cf448f8b02cd823da0f8601d2dff4d66f387a35f1e0@%3Cdev.atlas.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r2a5b84fdf59042dc398497e914b5bb1aed77328320b1438144ae1953@%3Cdev.atlas.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r2b05744c0c2867daa5d1a96832965b7d6220328b0ead06c22a6e7854@%3Ccommits.pulsar.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r2db207a2431a5e9e95e899858ab1f5eabd9bcc790a6ca7193ae07e94@%3Cdev.atlas.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r436988d2cfe8a770ae361c82b181c5b2bf48a249bad84d8a55a3b46e@%3Cdev.phoenix.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r4c682fb8cf69dd14162439656a6ebdf42ea6ad0e4edba95907ea3f14@%3Ccommits.servicecomb.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r4d7f37da1bc2df90a5a0f56eb7629b5ea131bfe11eeeb4b4c193f64a@%3Ccommon-issues.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r5510f0125ba409fc1cabd098ab8b457741e5fa314cbd0e61e4339422@%3Cdev.atlas.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r55d807f31e64a080c54455897c20b1667ec792e5915132c7b7750533@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r56805265475919252ba7fc10123f15b91097f3009bae86476624ca25@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r643ba53f002ae59068f9352fe1d82e1b6f375387ffb776f13efe8fda@%3Ccommon-issues.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r666f29a7d0e1f98fa1425ca01efcfa86e6e3856e01d300828aa7c6ea@%3Ccommits.pulsar.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r6c91e52b3cc9f4e64afe0f34f20507143fd1f756d12681a56a9b38da@%3Ccommits.pulsar.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r6d54c2da792c74cc14b9b7665ea89e144c9e238ed478d37fd56292e6@%3Cdev.atlas.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r72a3588d62b2de1361dc9648f5d355385735e47f7ba49d089b0e680d@%3Ccommon-issues.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r7ce3de03facf7e7f3e24fc25d26d555818519dafdb20f29398a3414b@%3Cdev.phoenix.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8464b6ec951aace8c807bac9ea526d4f9e3116aa16d38be06f7c6524@%3Ccommon-issues.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8b57c57cffa01e418868a3c7535b987635ff1fb5ab534203bfa2d64a@%3Ccommits.pulsar.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r900e020760c89f082df1c6e0d46320eba721e4e47bb9eb521e68cd95@%3Ccommits.servicecomb.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/raebd2019b3da8c2f90f31e8b203b45353f78770ca93bfe5376f5532e@%3Ccommon-issues.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rb0e033d5ec8233360203431ad96580cf2ec56f47d9a425d894e279c2@%3Cpr.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rb34d8d3269ad47a1400f5a1a2d8310e13a80b6576ebd7f512144198d@%3Ccommon-dev.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rb5c33d0069c927fae16084f0605895b98d231d7c48527bcb822ac48c@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rb7b28ac741e32dd5edb2c22485d635275bead7290b056ee56baf8ce0@%3Cdev.atlas.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rbaa1f513d903c89a08267c91d86811fa5bcc82e0596b6142c5cea7ea@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rc3211c71f7e0973a1825d1988a3921288c06cd9d793eae97ecd34948@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rcb2a7037366c58bac6aec6ce3df843a11ef97ae4eb049f05f410eaa5@%3Ccommon-commits.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rcb4b61dbe2ed1c7a88781a9aff5a9e7342cc7ed026aec0418ee67596@%3Ccommon-issues.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rce5c93bba6e815fb62ad38e28ca1943b3019af1eddeb06507ad4e11a@%3Ccommits.atlas.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rd582c64f66c354240290072f340505f5d026ca944ec417226bb0272e@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/re791a854001ec1f79cd4f47328b270e7a1d9d7056debb8f16d962722@%3Cdev.atlas.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/re851bbfbedd47c690b6e01942acb98ee08bd00df1a94910b905bc8cd@%3Cdev.atlas.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/reb1751562ee5146d3aca654a2df76a2c13d8036645ce69946f9c219e@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/recfe569f4f260328b0036f1c82b2956e864d519ab941a5e75d0d832d@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rf95bebee6dfcc55067cebe8482bd31e6f481d9f74ba8e03f860c3ec7@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKN7VGIKTYBCAKYBRG55QHXAY5UDZ7HA/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTVJC54XGX26UJVVYCXZ7D25X3R5T2G6/"},{"url":"https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r16ae4e529401b75a1f5aa462b272b31bf2a108236f882f06fddc14bc@%3Ccommon-issues.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r182e9cf6f3fb22b9be0cac4ff0685199741d2ab6e9a4e27a3693c224@%3Ccommon-issues.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r465d2553a31265b042cf5457ef649b71e0722ab89b6ea94a5d59529b@%3Ccommon-issues.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rdd34c0479587e32a656d976649409487d51ca0d296b3e26b6b89c3f5@%3Ccommon-commits.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rfe0aab6c3bebbd9cbfdedb65ff3fdf420714bcb8acdfd346077e1263@%3Ccommon-commits.hadoop.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rvwf-54qp-4r6v"},{"url":"https://vulners.com/cve/CVE-2017-18640","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-18640","tags":["advisory"]},{"url":"https://bitbucket.org/asomov/snakeyaml","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKN7VGIKTYBCAKYBRG55QHXAY5UDZ7HA","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTVJC54XGX26UJVVYCXZ7D25X3R5T2G6","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4807","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1785376","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4807.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18640","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18640","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4807","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211876-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159488","tags":["report"]},{"url":"https://bugzilla.suse.com/1186088","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18640","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211978-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211979-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-18640","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7368-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WBPEYN3HS4LO455EQKPMEZAUTFZIRGMT/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FQSQDG6EG5IGZXIQVLQHFSBMALXOT6L6/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-18640","description":"The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.","status":"published","published":"2019-12-12T00:00:00Z","modified":"2024-08-05T21:28:55.802Z","updated_at":"2026-11-02T14:33:21.747294Z"}],"euvd":[{"id":"EUVD-2021-1404","description":"The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.","status":"published","published":"2019-12-12T00:00:00Z","modified":"2024-08-05T21:28:55Z","updated_at":"2026-11-03T02:23:05.586343Z"}],"ghsa":[{"id":"GHSA-rvwf-54qp-4r6v","title":"SnakeYAML Entity Expansion during load operation","description":"The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.","status":"published","published":"2021-06-04T21:37:45Z","modified":"2023-05-22T20:17:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:36:53.103029Z"}],"nvd":[{"id":"CVE-2017-18640","description":"The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.","status":"published","published":"2019-12-12T03:15:10.85Z","modified":"2026-06-17T01:13:12.817Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:04:20.074898Z"}],"osv":[{"id":"CVE-2017-18640","description":"The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.","status":"published","published":"2019-12-12T03:15:10.85Z","modified":"2026-10-24T10:47:31.43583757Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-18640","description":"The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.","status":"published","published":"2019-12-12T03:15:10.85Z","modified":"2026-09-01T20:03:47.177972643Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"GHSA-rvwf-54qp-4r6v","title":"SnakeYAML Entity Expansion during load operation","description":"The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.","status":"published","published":"2021-06-04T21:37:45Z","modified":"2024-03-15T05:36:20.53964Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"RHSA-2020:4807","title":"Red Hat Security Advisory: prometheus-jmx-exporter security update","status":"published","published":"2024-09-13T13:43:39Z","modified":"2026-08-05T10:07:59Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2020:4807","title":"Moderate: prometheus-jmx-exporter security update","description":"Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target.\n\nSecurity Fix(es):\n\n* snakeyaml: Billion laughs attack via alias feature (CVE-2017-18640)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:37:53Z","modified":"2026-02-04T17:45:04.725345Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"ROOT-APP-MAVEN-CVE-2017-18640","title":"CVE-2017-18640 in org.yaml:snakeyaml - Patched by Root","description":"Root has patched CVE-2017-18640 in the org.yaml:snakeyaml package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-15T12:05:02Z","modified":"2026-09-15T13:15:05.043370946Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2017-18640","description":"The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.","status":"published","published":"2019-12-12T03:15:00Z","modified":"2026-02-04T03:00:34.302534Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"ALSA-2020:4807","title":"Moderate: prometheus-jmx-exporter security update","description":"Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target.\n\nSecurity Fix(es):\n\n* snakeyaml: Billion laughs attack via alias feature (CVE-2017-18640)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:37:53Z","modified":"2026-10-29T11:00:20.653029651Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2025-1755043490","title":"TuxCare security update for org.yaml:snakeyaml (8 CVEs)","description":"TuxCare rebuilt org.yaml:snakeyaml to address 8 CVEs. Fixed in 1.23.tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-10-15T09:45:03.068634667Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2026-1793723663","title":"TuxCare security update for org.yaml:snakeyaml (2 CVEs)","description":"TuxCare rebuilt org.yaml:snakeyaml to address 2 CVEs. Fixed in 1.7-tuxcare.3.","status":"published","published":"2026-11-03T17:34:24Z","modified":"2026-11-03T19:30:06.560797405Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CLSA-2026-1793724671","title":"TuxCare security update for org.yaml:snakeyaml (2 CVEs)","description":"TuxCare rebuilt org.yaml:snakeyaml to address 2 CVEs. Fixed in 1.8-tuxcare.3.","status":"published","published":"2026-11-03T17:51:12Z","modified":"2026-11-03T19:30:06.564811078Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CLSA-2026-1793725044","title":"TuxCare security update for org.yaml:snakeyaml (2 CVEs)","description":"TuxCare rebuilt org.yaml:snakeyaml to address 2 CVEs. Fixed in 1.6-tuxcare.2.","status":"published","published":"2026-11-03T17:57:24Z","modified":"2026-11-03T19:30:08.174243491Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"openSUSE-SU-2021:0855-1","title":"Security update for snakeyaml","description":"This update for snakeyaml fixes the following issues:\n\n- Upgrade to 1.28\n- CVE-2017-18640: The Alias feature allows entity expansion during a load operation (bsc#1159488, bsc#1186088)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-06-08T05:03:04Z","modified":"2026-02-04T02:16:44.832253Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1876-1","title":"Security update for snakeyaml","description":"This update for snakeyaml fixes the following issues:\n\n- Upgrade to 1.28\n- CVE-2017-18640: The Alias feature allows entity expansion during a load operation (bsc#1159488, bsc#1186088)\n","status":"published","published":"2021-07-11T08:53:50Z","modified":"2026-02-04T04:35:29.972776Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11391-1","title":"snakeyaml-1.28-2.2 on GA media","description":"These are all security issues fixed in the snakeyaml-1.28-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:25:39.540409Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:1876-1","title":"Security update for snakeyaml","description":"This update for snakeyaml fixes the following issues:\n\n- Upgrade to 1.28\n- CVE-2017-18640: The Alias feature allows entity expansion during a load operation (bsc#1159488, bsc#1186088)\n","status":"published","published":"2021-06-07T12:01:32Z","modified":"2026-02-04T02:48:52.202277Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1978-1","title":"Security update for snakeyaml","description":"This update for snakeyaml fixes the following issues:\n\n- Upgrade to 1.28\n- CVE-2017-18640: The Alias feature allows entity expansion during a load operation (bsc#1159488, bsc#1186088)\n","status":"published","published":"2021-06-15T11:06:43Z","modified":"2025-05-02T04:29:45.933691Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1979-1","title":"Security update for snakeyaml","description":"This update for snakeyaml fixes the following issues:\n\n- Upgrade to 1.28\n- CVE-2017-18640: The Alias feature allows entity expansion during a load operation (bsc#1159488, bsc#1186088)\n","status":"published","published":"2021-06-15T11:06:54Z","modified":"2026-02-04T03:32:15.933522Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-7368-1","title":"snakeyaml vulnerability","description":"It was discovered that SnakeYAML incorrectly handled recursive\nentity references. An attacker could possibly use this issue to\ncause SnakeYAML to crash, resulting in a denial of service.\n","status":"published","published":"2025-03-27T16:01:29Z","modified":"2026-06-25T13:32:30.210925444Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}