Description
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | snakeyaml | 1.25+ds-3 | — |
| Debian 13 | snakeyaml | 1.25+ds-3 | — |
| Debian 12 | snakeyaml | 1.25+ds-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | snakeyaml | 1.25+ds-2ubuntu0.1+esm1 | USN-7368-1 |
| Ubuntu Pro 18.04 LTS | snakeyaml | 1.23-1+deb10u1ubuntu0.1~esm1 | USN-7368-1 |
| Ubuntu Pro 16.04 LTS | snakeyaml | 1.12-2ubuntu0.16.04.1~esm2 | USN-7368-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | snakeyaml | 1.12-2ubuntu0.14.04.1~esm2 | USN-7368-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | prometheus-jmx-exporter | 0.12.0-6.el8 | RHSA-2020:4807 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | prometheus-jmx-exporter | 0.12.0-6.el8 | ALSA-2020:4807 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | prometheus-jmx-exporter | 0.12.0-6.el8 | RLSA-2020:4807 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | snakeyaml | 1.28-3.5.1 | SUSE-SU-2021:1876-1 |
| SLES 15 SP2 | snakeyaml | 1.28-3.5.1 | SUSE-SU-2021:1876-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.2 | snakeyaml | 1.28-3.5.1 | SUSE-SU-2021:1876-1 |
| SUSE Manager Server Module 4.1 | snakeyaml | 1.28-12.3.1 | SUSE-SU-2021:1979-1 |
| SUSE Manager Server Module 4.0 | snakeyaml | 1.28-12.3.1 | SUSE-SU-2021:1978-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | snakeyaml | 1.28-2.2 | openSUSE-SU-2024:11391-1 |
| openSUSE Leap 15.3 | snakeyaml | 1.28-3.5.1 | openSUSE-SU-2021:1876-1 |
| openSUSE Leap 15.2 | snakeyaml | 1.28-lp152.2.3.1 | openSUSE-SU-2021:0855-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | prometheus-jmx-exporter | 0.12.0-6.el8 | ELSA-2020-4807 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.yaml:snakeyaml | < 1.26 | 1.26 | GHSA-rvwf-54qp-4r6v |
Advisories 15
- ALSA-2020:4807 Moderate: prometheus-jmx-exporter security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-3721 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 4, 2026
- RHSA-2020:4807 Red Hat Security Advisory: prometheus-jmx-exporter security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-7368-1 snakeyaml vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- RLSA-2020:4807 Moderate: prometheus-jmx-exporter security update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2021:1876-1 Security update for snakeyaml SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11391-1 snakeyaml-1.28-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1979-1 Security update for snakeyaml SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:1876-1 Security update for snakeyaml SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0855-1 Security update for snakeyaml SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0770 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 8, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- SUSE-SU-2021:1978-1 Security update for snakeyaml SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
- ELSA-2020-4807 Moderate: prometheus-jmx-exporter security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2020
References
- FEDORA-2020-599514b47e vendor-advisory
- FEDORA-2020-23012fafbc vendor-advisory
- [pulsar-commits] 20200830 [GitHub] [pulsar] codelipenghui commented on issue #7928: CVE-2017-18640 exposure snakeyaml below 1.26 mailing-list
- [hadoop-common-dev] 20200830 [jira] [Created] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 mailing-list
- [hadoop-common-issues] 20200830 [jira] [Updated] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 mailing-list
- [hadoop-common-issues] 20200830 [jira] [Created] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 mailing-list
- [pulsar-commits] 20200831 [GitHub] [pulsar] wolfstudy edited a comment on issue #7928: CVE-2017-18640 exposure snakeyaml below 1.26 mailing-list
- [pulsar-commits] 20200831 [GitHub] [pulsar] wolfstudy commented on issue #7928: CVE-2017-18640 exposure snakeyaml below 1.26 mailing-list
- [hadoop-common-issues] 20200831 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 mailing-list
- [atlas-dev] 20200907 [GitHub] [atlas] crazylab opened a new pull request #109: Upgrade snakeyaml to a version without CVE-2017-18640 mailing-list
- [cassandra-pr] 20200907 [GitHub] [cassandra] crazylab opened a new pull request #736: Upgrade to a snakeyaml version without CVE mailing-list
- [atlas-dev] 20200907 [GitHub] [atlas] crazylab opened a new pull request #110: Upgrade snakeyaml to a version without CVE-2017-18640 mailing-list
- [atlas-dev] 20200907 [GitHub] [atlas] crazylab closed pull request #109: Upgrade snakeyaml to a version without CVE-2017-18640 mailing-list
- [pulsar-commits] 20200907 [GitHub] [pulsar] jiazhai closed issue #7928: CVE-2017-18640 exposure snakeyaml below 1.26 mailing-list
- [hadoop-common-issues] 20200909 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 mailing-list
- [atlas-dev] 20200914 [GitHub] [atlas] nixonrodrigues commented on pull request #110: ATLAS-3940 : Upgrade snakeyaml to a version without CVE-2017-18640 mailing-list
- [atlas-dev] 20200914 [jira] [Created] (ATLAS-3940) Upgrade snakeyaml to a version without CVE-2017-18640 mailing-list
- [atlas-dev] 20200914 [jira] [Updated] (ATLAS-3940) Upgrade snakeyaml to a version without CVE-2017-18640 mailing-list
- [atlas-commits] 20200915 [atlas] branch master updated: ATLAS-3940 : Upgrade snakeyaml to a version without CVE-2017-18640 (#110) mailing-list
- [atlas-dev] 20200915 [GitHub] [atlas] nixonrodrigues merged pull request #110: ATLAS-3940 : Upgrade snakeyaml to a version without CVE-2017-18640 mailing-list
- [atlas-dev] 20200915 [jira] [Commented] (ATLAS-3940) Upgrade snakeyaml to a version without CVE-2017-18640 mailing-list
- [atlas-commits] 20200916 [atlas] 02/02: ATLAS-3940 : Upgrade snakeyaml to a version without CVE-2017-18640 (#110) mailing-list
- [atlas-dev] 20200916 [jira] [Commented] (ATLAS-3940) Upgrade snakeyaml to a version without CVE-2017-18640 mailing-list
- [cassandra-commits] 20200930 [jira] [Created] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix mailing-list
- [cassandra-commits] 20200930 [jira] [Updated] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix mailing-list
- [cassandra-commits] 20200930 [jira] [Comment Edited] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix mailing-list
- [cassandra-commits] 20200930 [jira] [Commented] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix mailing-list
- [cassandra-commits] 20201001 [jira] [Commented] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix mailing-list
- [cassandra-commits] 20201002 [jira] [Commented] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix mailing-list
- [cassandra-commits] 20201002 [jira] [Comment Edited] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix mailing-list
- [cassandra-commits] 20201007 [jira] [Updated] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix mailing-list
- [cassandra-commits] 20201007 [jira] [Commented] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix mailing-list
- [cassandra-commits] 20201009 [jira] [Comment Edited] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix mailing-list
- [cassandra-commits] 20201009 [jira] [Commented] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix mailing-list
- [cassandra-commits] 20201009 [jira] [Updated] (CASSANDRA-16150) Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix mailing-list
- [cassandra-commits] 20201009 [cassandra] branch trunk updated: Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix mailing-list
- [hadoop-common-issues] 20201026 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 mailing-list
- [hadoop-common-issues] 20201027 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 mailing-list
- [hadoop-common-issues] 20201028 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 mailing-list
- [hadoop-common-issues] 20201028 [jira] [Updated] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 mailing-list
- [hadoop-common-commits] 20201028 [hadoop] branch trunk updated: HADOOP-17236. Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640. Contributed by Brahma Reddy Battula. mailing-list
- [hadoop-common-commits] 20201028 [hadoop] branch branch-3.3 updated: HADOOP-17236. Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640. Contributed by Brahma Reddy Battula. mailing-list
- [phoenix-dev] 20210419 [jira] [Created] (OMID-207) Upgrade to snakeyaml 1.26 due to CVE-2017-18640 mailing-list
- [phoenix-dev] 20210419 [GitHub] [phoenix-omid] richardantal opened a new pull request #93: OMID-207 Upgrade to snakeyaml 1.26 due to CVE-2017-18640 mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion
- https://mvnrepository.com/artifact/org.yaml/snakeyaml/1.25/usages
- https://bitbucket.org/asomov/snakeyaml/wiki/Billion%20laughs%20attack
- https://lists.apache.org/thread.html/r4c682fb8cf69dd14162439656a6ebdf42ea6ad0e4edba95907ea3f14%40%3Ccommits.servicecomb.apache.org%3E
- https://lists.apache.org/thread.html/r900e020760c89f082df1c6e0d46320eba721e4e47bb9eb521e68cd95%40%3Ccommits.servicecomb.apache.org%3E
- [kafka-users] 20210617 vulnerabilities mailing-list
- [hadoop-common-issues] 20211006 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 mailing-list
- [hadoop-common-commits] 20211008 [hadoop] branch branch-3.2.3 updated: HADOOP-17236. Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640. Contributed by Brahma Reddy Battula. mailing-list
- [hadoop-common-issues] 20211008 [jira] [Updated] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 mailing-list
- [hadoop-common-commits] 20211008 [hadoop] branch branch-3.2 updated: HADOOP-17236. Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640. Contributed by Brahma Reddy Battula. mailing-list
- [hadoop-common-issues] 20211008 [jira] [Commented] (HADOOP-17236) Bump up snakeyaml to 1.26 to mitigate CVE-2017-18640 mailing-list
- https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes
- https://bitbucket.org/snakeyaml/snakeyaml/issues/377
- GLSA-202305-28 vendor-advisory