CVE-2022-38751: snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write
6.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.39431%
CWE
Published
9/6/2022
Updated
3/15/2024
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.yaml:snakeyaml | maven | < 1.31 | 1.31 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability manifests in regex processing during YAML parsing. Key evidence comes from:
- The test case Fuzzy47039Test.java showing stack overflow in regex processing
- CWE-121/787 mapping to uncontrolled recursion in parsing logic
- Patch focus on adding length checks before regex operations
ScannerImpl.scanTag() is primary suspect as it handles tag parsing (like '!!str') where malicious tags would be processed. Resolver.resolve() is secondary vector as type detection uses regex patterns. Both would appear in stack traces during exploitation when processing malicious YAML content.