CVE-2020-1947

CVE-2020-1947 Apache ShardingSphere UI YAML 파싱 원격 코드 실행 취약점 재현 0x01 shardingsphere 바이너리 패키지 다운로드 wget https://mirror-hk.koddos.net/apache/incubator/shardingsphere/4.0.0/apache-shardingsphere-incubating-4.0.0-sharding-ui-bin.tar.gz 압축 해제 root@kitploit: root@kali tar -xf...

snakeyaml_cve_poc

snakeyamlcvepoc SnakeYAML-CVE-2022-1471-POC 빌드 호스트에서 mvn clean compile assembly:single로 jar를 빌드하거나 docker를 사용하여 docker build -t snakeyaml .로 이미지를 빌드하세요. 실행 컨테이너를 docker run --rm -p8080:8080 snakeyaml로 실행하거나 호스트에서 빌드한 jar를 java -jar target/snakeyaml-1.0-SNAPSHOT-jar-with-dependencies.jar로 실행하세요. 사...

loader-CVE-2020-14343

loader-CVE-2020-14343 PyYAML 패키지에서 CVE-2020-14343의 안전하지 않은 역직렬화를 통해 명령 실행이 가능한 웹 애플리케이션입니다. 해설: https://github.com/TebbaaX/CTFs/blob/main/HackerNewsBdarija-CTF-2022/loadder/Loader.md...

Kubernetes API Server - YAML Parsing DoS (Billion Laughs)

The Kubernetes API server is vulnerable to a denial of service attack via YAML/JSON parsing. An attacker can send a specially crafted YAML/JSON payload that causes exponential memory consumption Billion Laughs attack, leading to API server crash. id: CVE-2019-11253 info: name: Kubernetes API Serv...

docling-core-CVE-2026-24009

CVE-2026-24009 — docling-core 안전하지 않은 YAML 역직렬화 PoC + 참고 사항 이 저장소는 CVE-2026-24009 를 입증하는 개념 증명PoC과 간단한 스캐너를 포함합니다. 이 취약점은 특정 종속성 조건에서 docling-core가 공격자가 제어하는 YAML을 로드할 때 코드 실행을 가능하게 합니다. TL;DR 영향: YAML 파싱 중 잠재적 RCE 취약한 체인모두 필요: docling-core = 2.21.0 및 = 2.48.4로 업그레이드 yaml.SafeLoader로 전환 대체 수정:...

cve-2022-1471-jira-lab

CVE-2022-1471 — SnakeYAML RCE 랩 Jira / Automation for Jira 컨텍스트 CVE-2022-1471SnakeYAML 안전하지 않은 역직렬화 → RCE, CVSS 9.8의 메커니즘을 입증하는 오프라인 자체 포함형 랩으로, Jira / Jira Service Management에서 9.4.9 를 실행 중인 호스트를 대상으로 한 발견 사항에 사용된 방식입니다영향 범위 9.4.0–9.4.12, 9.4.14에서 수정됨 — Atlassian JSDSERVER-14906 참조. 이 랩은 정확히 두 가...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

EUVD-2026-69712

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources...

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example yaml arr: &arr , , , ... N empty mappings targets: - : arr repeated K times For every target, the loader...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

CVE-2026-84375

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge targets,...

CVE-2026-84375

js-yaml , a widely used JavaScript YAML parser, is vulnerable to a CPU exhaustion issue in its merge-key (<

PT-2026-84523

Name of the Vulnerable Software and Affected Versions js-yaml versions 3.0.0 through 3.15.1 js-yaml versions prior to 4.3.2 Description An issue exists where maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js fails to count empty mapping sources when processing the merge key . This allo...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nodejs-grunt (UTSA-2026-093223)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093223 advisory. The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of...

Astra Linux – Vulnerability in snakeyaml

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user-supplied input, an attacker may provide content that causes the parser to crash due to a stack overflow...

EUVD-2026-51537

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...