CVE-2022-1471: SnakeYAML Deserialization Deep Dive | Grey Noise Blog

Summary: SnakeYAML versions before 2.0 allow remote code execution when parsing untrusted input, because the library by default permits instantiation of arbitrary Java classes from untrusted YAML sources. GreyNoise Labs researcher Ron Bowes notes this insecure-by-default design led to at least eight different vulnerabilities before the issue was formally designated CVE-2022-1471.
Bottom line: A library that instantiates arbitrary Java classes from untrusted input by default turned into at least eight separate vulnerabilities before it got a CVE, and the source notes unhelpful responses from its developers - so the fix depends on your own inventory of where SnakeYAML is embedded, not on an upstream patch arriving.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-1471
Related: Oracle Patch Tuesday, October 2023 Security Update Review | Qualys Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026