Kubernetes API Server - YAML Parsing DoS (Billion Laughs)

The Kubernetes API server is vulnerable to a denial of service attack via YAML/JSON parsing. An attacker can send a specially crafted YAML/JSON payload that causes exponential memory consumption Billion Laughs attack, leading to API server crash. id: CVE-2019-11253 info: name: Kubernetes API Serv...

loader-CVE-2020-14343

loader-CVE-2020-14343 Eine Webanwendung, die anfällig für CVE-2020-14343 unsichere Deserialisierung ist, was zu Befehlsausführung im PyYAML-Paket führt. Aufschlüsselung: https://github.com/TebbaaX/CTFs/blob/main/HackerNewsBdarija-CTF-2022/loadder/Loader.md...

CVE-2020-1947

CVE-2020-1947 Apache ShardingSphere UI YAML-Parsing Remote Code Execution Vulnerability Reproduktion 0x01 Herunterladen des shardingsphere Binary-Pakets wget https://mirror-hk.koddos.net/apache/incubator/shardingsphere/4.0.0/apache-shardingsphere-incubating-4.0.0-sharding-ui-bin.tar.gz Entpacken...

snakeyaml_cve_poc

snakeyamlcvepoc SnakeYAML-CVE-2022-1471-POC Erstellen Entweder erstellen Sie das Jar auf Ihrem Host mit mvn clean compile assembly:single Oder verwenden Sie docker, um ein Image mit docker build -t snakeyaml . zu erstellen Ausführen Führen Sie den Container mit docker run --rm -p8080:8080 snakeya...

docling-core-CVE-2026-24009

CVE-2026-24009 — docling-core Unsichere YAML-Deserialisierung PoC + Hinweise Dieses Repository enthält einen Proof-of-Concept PoC und einen einfachen Scanner, die CVE-2026-24009 demonstrieren, bei dem docling-core unter bestimmten Abhängigkeitsbedingungen die Codeausführung beim Laden von...

cve-2022-1471-jira-lab

CVE-2022-1471 — SnakeYAML-RCE-Labor Jira-/Automation-for-Jira-Kontext Offline, in sich geschlossenes Labor, das den Mechanismus hinter CVE-2022-1471 unsichere SnakeYAML-Deserialisierung → RCE, CVSS 9.8 nachweist, wie er in dem Befund zu Jira / Jira Service Management gegen einen Host mit 9.4.9...

CLEANSTART-2026-QZ30630 Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS)

Security vulnerability affects the apache-hive package. Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS...

CLEANSTART-2026-YW99186 Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS)

Security vulnerability affects the apache-hive package. Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

Astra Linux – Vulnerability in snakeyaml

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user-supplied input, an attacker may provide content that causes the parser to crash due to a stack overflow...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

EUVD-2026-69712

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources...

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

SUSE CVE-2026-84375

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

CVE-2026-84375

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge...