ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +11430 more potentially affected by CVE-2026-115876 via com.fasterxml.jackson.dataformat:jackson-dataformat-yaml (>=2.19.0, <=2.21.5)

com.fasterxml.jackson.dataformat:jackson-dataformat-yaml MAVEN version =2.19.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.4.0, =0.0.2, =0.0.2, =0.8.4 and more...

CVE-2026-115876

Summary "YAMLAnchorReplayingParser" in "jackson-dataformat-yaml" available since 2.19.0 handles YAML merge keys "" through unbounded recursion. A crafted YAML document with approximately 3,271 levels of nested "" keys 20 KB triggers "StackOverflowError" on the parsing thread. Because...

ai.astraform:conformance-java (0.4.5), ai.astraform:remote-domain-author-kit-java (>=0.4.1, <=0.4.4) +1005 more potentially affected by CVE-2026-115876 via tools.jackson.dataformat:jackson-dataformat-yaml (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-yaml MAVEN version =3.2.0, =0.4.1, =0.3.0, =0.4.1, =1.4.0, =1.4.0, =3.10.0-rc1-bin-20260730-ae2ed95-nightly, =4.5.0, =4.5.0, =2.3.6-fx4, =2.3.6-fx5 and more Source cves: CVE-2026-115876 Source advisory: MEND:CVE-2026-115876...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +2181 more potentially affected by CVE-2026-115876 via tools.jackson.dataformat:jackson-dataformat-yaml (>=3.1.0, <=3.1.5)

tools.jackson.dataformat:jackson-dataformat-yaml MAVEN version =3.1.0, =0.0.1, =0.1.0, =0.9.3, =0.9.4, =0.9.7, =0.9.3, =0.9.9, =0.9.6, =0.9.3, =0.9.3, =0.9.9, =0.9.3, =0.9.3, =1.0.0-beta.1, =1.0.0-beta.8 and more Source cves: CVE-2026-115876 Source advisory: MEND:CVE-2026-115876...

ai.pipestream.module:module-chunker (>=0.1.4, <=0.1.5), ai.pipestream.module:module-echo (0.1.4) +2528 more potentially affected by CVE-2026-115876 via com.fasterxml.jackson.dataformat:jackson-dataformat-yaml (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.dataformat:jackson-dataformat-yaml MAVEN version =2.22.0, =0.1.4, =0.3.0, =0.1.2, =0.1.4, =0.7.30, =0.7.30, =0.7.41 and more Source cves: CVE-2026-115876 Source advisory: MEND:CVE-2026-115876...

ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +6938 more potentially affected by unknown CVE via com.fasterxml.jackson.dataformat:jackson-dataformat-yaml (>=2.21.0, <=2.21.5)

com.fasterxml.jackson.dataformat:jackson-dataformat-yaml MAVEN version =2.21.0, =0.1.0, =0.1.0, =0.4.0, =0.0.2, =0.0.2, =0.0.2, =0.6.0, =0.0.2, =0.0.3, =0.8.1, =0.8.1, =0.8.1, =0.0.2, =0.0.2, =0.8.4 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0134...

WS-2026-0134

jackson-dataformat-yaml: StackOverflowError via deeply nested YAML merge keys in YAMLAnchorReplayingParser...

ai.astraform:conformance-java (0.4.5), ai.astraform:remote-domain-author-kit-java (>=0.4.1, <=0.4.4) +1005 more potentially affected by unknown CVE via tools.jackson.dataformat:jackson-dataformat-yaml (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-yaml MAVEN version =3.2.0, =0.4.1, =0.3.0, =0.4.1, =1.4.0, =1.4.0, =3.10.0-rc1-bin-20260730-ae2ed95-nightly, =4.5.0, =4.5.0, =2.3.6-fx4, =2.3.6-fx5 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0134...

ai.pipestream.module:module-chunker (>=0.1.4, <=0.1.5), ai.pipestream.module:module-echo (0.1.4) +2528 more potentially affected by unknown CVE via com.fasterxml.jackson.dataformat:jackson-dataformat-yaml (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.dataformat:jackson-dataformat-yaml MAVEN version =2.22.0, =0.1.4, =0.3.0, =0.1.2, =0.1.4, =0.7.30, =0.7.30, =0.7.41 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0134...

Deserialization of Untrusted Data in apache-submarine

Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handle YAML requests using application/yaml content-type, it defin...

PYSEC-2023-240

Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handle YAML requests using application/yaml content-type, it defin...

Design/Logic Flaw

Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handle YAML requests using application/yaml content-type, it defin...

CVE-2023-46302 Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization

Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handle YAML requests using application/yaml content-type, it defin...

CVE-2023-46302 Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization

Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handle YAML requests using application/yaml content-type, it defin...

CVE-2023-46302

CVE-2023-46302 affects Apache Submarine (0.7.0–0.8.0 pre-upgrade) where YAML deserialization in the YamlUtils.yaml processing path (SnakeYAML-based) can lead to remote code execution. The issue arises during unmarshalling of YAML requests via JAXRS endpoints using application/yaml content-type; t...