{"id":"RHLW-2026-c782a5bb98e3a176","summary":"Lightwell Security Advisory: snakeyaml 1.29.0.rhlw-00021","details":"Red Hat Lightwell has released org.yaml:snakeyaml 1.29.0.rhlw-00021 with backported fixes for CVE-2022-1471, CVE-2022-25857, CVE-2022-38749, CVE-2022-38750, CVE-2022-38751, CVE-2022-38752, and CVE-2022-41854.\n\nCVE-2022-1471: Remote Code execution in SnakeYAML\n\nCVE-2022-25857: Denial of Service (DoS)\n\nCVE-2022-38749: DoS in SnakeYAML\n\nCVE-2022-38750: DoS in SnakeYAML\n\nCVE-2022-38751: DoS in SnakeYAML\n\nCVE-2022-38752: DoS in SnakeYAML\n\nCVE-2022-41854: Stack Overflow in Snakeyaml\n\nThis patched artifact is a drop-in replacement for org.yaml:snakeyaml 1.29.0 from Maven Central.","modified":"2026-10-22T00:08:30.140309140Z","published":"2026-10-08T19:46:26Z","upstream":["CVE-2022-1471","CVE-2022-25857","CVE-2022-38749","CVE-2022-38750","CVE-2022-38751","CVE-2022-38752","CVE-2022-41854","GHSA-3mc7-4q67-w48m","GHSA-98wm-3w3q-mw94","GHSA-9w3m-gqgf-c4p9","GHSA-c4r9-r8fh-9vj2","GHSA-hhhw-99gj-p3c3","GHSA-mjmj-j48q-9wg2","GHSA-w37g-rhq8-7m4j"],"references":[{"type":"REPORT","url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479"},{"type":"WEB","url":"https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1471.json"},{"type":"ADVISORY","url":"https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1471"},{"type":"PACKAGE","url":"https://github.com/mbechler/marshalsec"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mjmj-j48q-9wg2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25857.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25857"},{"type":"REPORT","url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/525"},{"type":"FIX","url":"https://bitbucket.org/snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174"},{"type":"FIX","url":"https://github.com/snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-3mc7-4q67-w48m"},{"type":"REPORT","url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/525/got-stackoverflowerror-for-many-open"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38749.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38749"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-c4r9-r8fh-9vj2"},{"type":"REPORT","url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/526/stackoverflow-oss-fuzz-47027"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38750.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38750"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hhhw-99gj-p3c3"},{"type":"REPORT","url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/530/stackoverflow-oss-fuzz-47039"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38751.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38751"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-98wm-3w3q-mw94"},{"type":"REPORT","url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38752.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38752"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9w3m-gqgf-c4p9"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41854.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41854"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w37g-rhq8-7m4j"}],"affected":[{"package":{"name":"org.yaml:snakeyaml","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/org.yaml/snakeyaml"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.0.rhlw-00021"}]}],"versions":["1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.19","1.20","1.21","1.22","1.23","1.24","1.25","1.26","1.27","1.28","1.29","1.29.0","1.4","1.5","1.6","1.7","1.8","1.9"],"database_specific":{"lightwell":{"backport_base_version":"1.29.0","remediated_version":"1.29.0.rhlw-00021","repository_url":"https://packages.redhat.com/lightwell/java/remediated/"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-c782a5bb98e3a176.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}