What’s Vulnerable › Vulnerabilities
CVE-2017-18640
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 26.7% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2019-12-12 · updated 2026-06-17
- Weakness: CWE-776
Description
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Affected products
- Fedoraproject Fedora: 31, 32
- Oracle Peoplesoft Enterprise Pt Peopletools: 8.56, 8.57, 8.58
- quarkusio quarkus: through 1.3.4
- SnakeYAML: before 1.26 — fixed in 1.26
How to fix
Upgrade to a fixed version: SnakeYAML 1.26. Check the vendor advisory for mitigations.
References
- https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion
- https://bitbucket.org/asomov/snakeyaml/wiki/Billion%20laughs%20attack
- https://bitbucket.org/snakeyaml/snakeyaml/issues/377
- https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes
- https://lists.apache.org/thread.html/r1058e7646988394de6a3fd0857ea9b1ee0de14d7bb28fee5ff782457%40%3Ccommits.atlas.apache.org%3E
- https://lists.apache.org/thread.html/r154090b871cf96d985b90864442d84eb027c72c94bc3f0a5727ba2d1%40%3Ccommon-issues.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/r16ae4e529401b75a1f5aa462b272b31bf2a108236f882f06fddc14bc%40%3Ccommon-issues.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/r1703a402f30c8a2ee409f8c6f393e95a63f8c952cc9ee5bf9dd586dc%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/r182e9cf6f3fb22b9be0cac4ff0685199741d2ab6e9a4e27a3693c224%40%3Ccommon-issues.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/r191ceadb1b883357384981848dfa5235cb02a90070c553afbaf9b3d9%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/r1aab47b48a757c70e40fc0bcb1fcf1a3951afa6a17aee7cd66cf79f8%40%3Ccommon-commits.hadoop.apache.org%3E
- https://lists.apache.org/thread.html/r1dfac8b6a7097bcb4979402bbb6e2f8c36d0d9001e3018717eb22b7e%40%3Cdev.atlas.apache.org%3E
Get alerted when CVE-2017-18640 or the next vulnerability affects your stack