CVE-2026-115876

Summary "YAMLAnchorReplayingParser" in "jackson-dataformat-yaml" available since 2.19.0 handles YAML merge keys "" through unbounded recursion. A crafted YAML document with approximately 3,271 levels of nested "" keys 20 KB triggers "StackOverflowError" on the parsing thread. Because...

WS-2026-0134

jackson-dataformat-yaml: StackOverflowError via deeply nested YAML merge keys in YAMLAnchorReplayingParser...

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

PT-2026-109358

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in js-yaml (CVE-2026-59869)

Summary A Prototype Pollution vulnerability in the js-yaml document parsing library CVE-2026-59869 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 4.3.1. Vulnerability Details CVEID:CVE-2026-59869 DESCRIPTION: js-yaml is a JavaScript YAML parse...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

GHSA-2883-XCG3-V3HH js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

CVE-2026-84375

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

Security Bulletin: Vulnerability in js-yaml affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in js-yaml has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabili...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...