CVE-2022-38749: snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write

The vulnerability stems from uncontrolled recursion during YAML parsing of nested structures. The Composer class methods composeSequenceNode and composeMappingNode are core recursive processing points that lacked depth validation in vulnerable versions. Stack traces during exploitation would show repeated calls to these methods until stack overflow occurs. The patch adding depth limits (commit fc30078) confirms these as the vulnerable entry points. composeNode appears in traces as the parent caller but isn't directly vulnerable itself.