CVE-2023-47163

2023-11-1302:26:42

jpcert

www.cve.org

remarshal vulnerability

yaml alias

billion laughs attack

denial-of-service

EPSS

0.001

Percentile

18.8%

JSON

Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition.

CNA Affected

[
  {
    "vendor": "Remarshal-project",
    "product": "Remarshal",
    "versions": [
      {
        "version": "prior to v0.17.1",
        "status": "affected"
      }
    ]
  }
]