# org.yaml:snakeyaml (Maven) vulnerabilities

8 known vulnerabilities (2 high, 5 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 2.7 (Aug 30, 2026): no advisory affects it
- Newest unaffected release: 2.7 (Aug 30, 2026), the latest release
- Dependents: 2,554
- Releases: 38 since 1.4 (Aug 26, 2009)
- Registry: https://central.sonatype.com/artifact/org.yaml/snakeyaml
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2022-1471: 1.4 to 1.33 (2.0 is outside it)
- CVE-2022-41854: 1.4 to 1.31 (1.32 is outside it)
- CVE-2022-38752: 1.4 to 1.31 (1.32 is outside it)
- CVE-2022-38751: 1.4 to 1.30 (1.31 is outside it)
- CVE-2022-38750: 1.4 to 1.30 (1.31 is outside it)
- CVE-2022-38749: 1.4 to 1.30 (1.31 is outside it)
- CVE-2022-25857: 1.4 to 1.30 (1.31 is outside it)
- CVE-2017-18640: 1.4 to 1.25 (1.26 is outside it)

## Advisories (8)

### [CVE-2022-1471](https://cve.now/CVE-2022-1471): Remote Code execution in SnakeYAML

- Severity: High 8.3
- Published: Dec 1, 2022
- Affected: fixed in 2.0.
- Fixed in 2.0 (released Feb 26, 2023, 87 days after disclosure).
- The latest release, 2.7, is not affected.

### [CVE-2022-41854](https://cve.now/CVE-2022-41854): Stack Overflow in Snakeyaml

- Severity: Medium 5.8
- Published: Nov 11, 2022
- Affected: fixed in 1.32.
- Fixed in 1.32 (released Sep 12, 2022, 60 days before disclosure).
- The latest release, 2.7, is not affected.

### [CVE-2022-38752](https://cve.now/CVE-2022-38752): DoS in SnakeYAML

- Severity: Medium 6.5
- Published: Sep 5, 2022
- Affected: fixed in 1.32.
- Fixed in 1.32 (released Sep 12, 2022, 7 days after disclosure).
- The latest release, 2.7, is not affected.

### [CVE-2022-38751](https://cve.now/CVE-2022-38751): DoS in SnakeYAML

- Severity: Medium 6.5
- Published: Sep 5, 2022
- Affected: fixed in 1.31.
- Fixed in 1.31 (released Aug 27, 2022, 9 days before disclosure).
- The latest release, 2.7, is not affected.

### [CVE-2022-38750](https://cve.now/CVE-2022-38750): DoS in SnakeYAML

- Severity: Medium 6.5
- Published: Sep 5, 2022
- Affected: fixed in 1.31.
- Fixed in 1.31 (released Aug 27, 2022, 9 days before disclosure).
- The latest release, 2.7, is not affected.

### [CVE-2022-38749](https://cve.now/CVE-2022-38749): DoS in SnakeYAML

- Severity: Medium 6.5
- Published: Sep 5, 2022
- Affected: fixed in 1.31.
- Fixed in 1.31 (released Aug 27, 2022, 9 days before disclosure).
- The latest release, 2.7, is not affected.

### [CVE-2022-25857](https://cve.now/CVE-2022-25857): Denial of Service (DoS)

- Severity: High 7.5
- Published: Aug 30, 2022
- Affected: fixed in 1.31.
- Fixed in 1.31 (released Aug 27, 2022, 3 days before disclosure).
- The latest release, 2.7, is not affected.

### [CVE-2017-18640](https://cve.now/CVE-2017-18640): The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

- Severity: Unrated
- Published: Dec 12, 2019
- Affected: fixed in 1.26.
- Fixed in 1.26 (released Feb 28, 2020, 78 days after disclosure).
- The latest release, 2.7, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.yaml:snakeyaml
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.