CVE-2026-73643 js-yaml: Exponential parsing time in the flow collections leads to denial of service

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...

commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

CLEANSTART-2026-ZO84411 Security fixes in prometheus-alertmanager 0.26.0-r0

Package prometheus-alertmanager version 0.26.0-r0 fixes 1 vulnerabilities: CVE-2023-40577...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

Security Bulletin: IBM Maximo Application Suite uses js-yaml-4.1.1.tgz which is vulnerable to CVE-2026-53550.

Summary IBM Maximo Application Suite uses js-yaml-4.1.1.tgz which is vulnerable to CVE-2026-53550. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-53550 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0...

Security Bulletin:Vulnerability in js-yaml affects IBM Netezza Appliance

Summary The js-yaml package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-53550 Vulnerability Details CVEID:CVE-2026-53550 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigge...

DoS (Denial of Service) js-yaml Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.1, 9.3.0, 9.4.0, 9.5.0, 9.6.5, 10.0.0, 10.1.4, 10.2.0, 10.3.2, and 10.4.1 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

[SECURITY] [DLA 4730-1] libyaml-syck-perl security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4730-1 [email protected] https://www.debian.org/lts/security/ Salvatore Bonaccorso August 10, 2026 https://wiki.debian.org/LTS -...

CVE-2026-72735

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...

CVE-2026-72735

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...

EUVD-2026-55681

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed...

CVE-2026-72735

Dokploy (PaaS) before v0.29.13 is affected by a command-injection in writeTraefikConfigRemote: user-controlled YAML is serialized via yaml.stringify and interpolated into an echo/exeсAsyncRemote command, where single quotes in redirect regex, authentication usernames, domain values, or middleware...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses js-yaml which is vulnerable to CVE-2025-64718, CVE-2026-53550, CVE-2026-59869

Summary IBM Maximo Application Suite - Visual Inspection component uses js-yaml which is vulnerable to CVE-2025-64718, CVE-2026-53550, CVE-2026-59869, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-53550 DESCRIPTION: js-yam...

Debian dsa-6428 : libyaml-syck-perl - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6428 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6428-1 [email protected] https://www.debian.org/securit...

nuclei v3.11.1

English • 中文 • Korean • Indonesia • Spanish • 日本語 • Portuguese • Türkçe...

Security Bulletin: Apache Commons Configuration Denial of Service via YAML Cycle

Summary Apache Commons Configuration versions 2.2 through 2.14.x are vulnerable to an uncontrolled recursion denial of service. When parsing an untrusted YAML configuration file that contains cyclic references, the library throws a StackOverflowError, which can crash the processing thread and mak...

OESA-2026-3240 perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. Including...

OESA-2026-3239 perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. Including...

OESA-2026-3238 perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. Including...

OESA-2026-3237 perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. Including...