High USN-7368-1 1 CVE

snakeyaml vulnerability

Published Mar 27, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that SnakeYAML incorrectly handled recursive
entity references. An attacker could possibly use this issue to
cause SnakeYAML to crash, resulting in a denial of service.

Fixed packages 4

Release	Package	Fixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	snakeyaml	1.12-2ubuntu0.14.04.1~esm2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	snakeyaml	1.12-2ubuntu0.16.04.1~esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS	snakeyaml	1.23-1+deb10u1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS	snakeyaml	1.25+ds-2ubuntu0.1+esm1

Vulnerabilities 1

High 7.5

CVE-2017-18640 EPSS 27%

SnakeYAML Entity Expansion during load operation

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

org.yaml:snakeyaml snakeyaml snakeyaml Debian Ubuntu Maven

Dec 12, 2019

References

report
https://ubuntu.com/security/CVE-2017-18640