MavenPackage

org.yaml:snakeyaml

8 known vulnerabilities (2 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release: 2.7 (Aug 30, 2026): no advisory affects it
Newest unaffected release: 2.7 (Aug 30, 2026), the latest release
Advisories: 8 · 2 high, 5 medium

Dependents: 2,554
Releases: 38 since 1.4 (Aug 26, 2009)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2022-1471
Affects 1.4 to 1.33 (2.0 is outside it)
CVE-2022-41854
Affects 1.4 to 1.31 (1.32 is outside it)
CVE-2022-38752
Affects 1.4 to 1.31 (1.32 is outside it)
CVE-2022-38751
Affects 1.4 to 1.30 (1.31 is outside it)
CVE-2022-38750
Affects 1.4 to 1.30 (1.31 is outside it)
CVE-2022-38749
Affects 1.4 to 1.30 (1.31 is outside it)
CVE-2022-25857
Affects 1.4 to 1.30 (1.31 is outside it)
CVE-2017-18640
Affects 1.4 to 1.25 (1.26 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2022-1471High 8.3
Remote Code execution in SnakeYAML
Affected: fixed in 2.0.
Fixed in 2.0 (released Feb 26, 2023, 87 days after disclosure).
The latest release, 2.7, is not affected.
CVE-2022-41854Medium 5.8
Stack Overflow in Snakeyaml
Affected: fixed in 1.32.
Fixed in 1.32 (released Sep 12, 2022, 60 days before disclosure).
The latest release, 2.7, is not affected.
CVE-2022-38752Medium 6.5
DoS in SnakeYAML
Affected: fixed in 1.32.
Fixed in 1.32 (released Sep 12, 2022, 7 days after disclosure).
The latest release, 2.7, is not affected.
CVE-2022-38751Medium 6.5
DoS in SnakeYAML
Affected: fixed in 1.31.
Fixed in 1.31 (released Aug 27, 2022, 9 days before disclosure).
The latest release, 2.7, is not affected.
CVE-2022-38750Medium 6.5
DoS in SnakeYAML
Affected: fixed in 1.31.
Fixed in 1.31 (released Aug 27, 2022, 9 days before disclosure).
The latest release, 2.7, is not affected.
CVE-2022-38749Medium 6.5
DoS in SnakeYAML
Affected: fixed in 1.31.
Fixed in 1.31 (released Aug 27, 2022, 9 days before disclosure).
The latest release, 2.7, is not affected.
CVE-2022-25857High 7.5
Denial of Service (DoS)
Affected: fixed in 1.31.
Fixed in 1.31 (released Aug 27, 2022, 3 days before disclosure).
The latest release, 2.7, is not affected.
CVE-2017-18640Unrated
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Affected: fixed in 1.26.
Fixed in 1.26 (released Feb 28, 2020, 78 days after disclosure).
The latest release, 2.7, is not affected.