Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-fb8u-g65k-hffs
Vulnerability ID VCID-fb8u-g65k-hffs
Aliases CVE-2022-38752
GHSA-9w3m-gqgf-c4p9
Summary snakeYAML before 1.32 vulnerable to Denial of Service due to Out-of-bounds Write Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DoS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-121 Stack-based Buffer Overflow
CWE-787 Out-of-bounds Write
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-38752.json
epss 0.00166 https://api.first.org/data/v1/epss?cve=CVE-2022-38752
epss 0.00166 https://api.first.org/data/v1/epss?cve=CVE-2022-38752
epss 0.00166 https://api.first.org/data/v1/epss?cve=CVE-2022-38752
epss 0.00166 https://api.first.org/data/v1/epss?cve=CVE-2022-38752
epss 0.00166 https://api.first.org/data/v1/epss?cve=CVE-2022-38752
epss 0.00166 https://api.first.org/data/v1/epss?cve=CVE-2022-38752
epss 0.00166 https://api.first.org/data/v1/epss?cve=CVE-2022-38752
epss 0.00166 https://api.first.org/data/v1/epss?cve=CVE-2022-38752
epss 0.00205 https://api.first.org/data/v1/epss?cve=CVE-2022-38752
epss 0.00205 https://api.first.org/data/v1/epss?cve=CVE-2022-38752
epss 0.00205 https://api.first.org/data/v1/epss?cve=CVE-2022-38752
epss 0.00205 https://api.first.org/data/v1/epss?cve=CVE-2022-38752
cvssv3.1 6.5 https://bitbucket.org/snakeyaml/snakeyaml
generic_textual MODERATE https://bitbucket.org/snakeyaml/snakeyaml
cvssv3.1 6.5 https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081
generic_textual MODERATE https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081
ssvc Track https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081
cvssv3.1 6.5 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47081
generic_textual MODERATE https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47081
ssvc Track https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47081
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-9w3m-gqgf-c4p9
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2022-38752
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-38752
cvssv3.1 6.5 https://security.gentoo.org/glsa/202305-28
generic_textual MODERATE https://security.gentoo.org/glsa/202305-28
ssvc Track https://security.gentoo.org/glsa/202305-28
cvssv3.1 6.5 https://security.netapp.com/advisory/ntap-20240315-0009
generic_textual MODERATE https://security.netapp.com/advisory/ntap-20240315-0009
cvssv3.1 6.5 https://security.netapp.com/advisory/ntap-20240315-0009/
ssvc Track https://security.netapp.com/advisory/ntap-20240315-0009/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-38752.json
https://api.first.org/data/v1/epss?cve=CVE-2022-38752
https://bitbucket.org/snakeyaml/snakeyaml
https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47081
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38752
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://nvd.nist.gov/vuln/detail/CVE-2022-38752
https://security.gentoo.org/glsa/202305-28
https://security.netapp.com/advisory/ntap-20240315-0009
1021014 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1021014
2129710 https://bugzilla.redhat.com/show_bug.cgi?id=2129710
GHSA-9w3m-gqgf-c4p9 https://github.com/advisories/GHSA-9w3m-gqgf-c4p9
ntap-20240315-0009 https://security.netapp.com/advisory/ntap-20240315-0009/
RHSA-2022:6757 https://access.redhat.com/errata/RHSA-2022:6757
RHSA-2022:8524 https://access.redhat.com/errata/RHSA-2022:8524
RHSA-2023:0189 https://access.redhat.com/errata/RHSA-2023:0189
RHSA-2023:2097 https://access.redhat.com/errata/RHSA-2023:2097
RHSA-2023:2100 https://access.redhat.com/errata/RHSA-2023:2100
RHSA-2023:2705 https://access.redhat.com/errata/RHSA-2023:2705
RHSA-2023:2706 https://access.redhat.com/errata/RHSA-2023:2706
RHSA-2023:2707 https://access.redhat.com/errata/RHSA-2023:2707
RHSA-2023:2710 https://access.redhat.com/errata/RHSA-2023:2710
RHSA-2023:2713 https://access.redhat.com/errata/RHSA-2023:2713
RHSA-2023:3641 https://access.redhat.com/errata/RHSA-2023:3641
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-38752.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://bitbucket.org/snakeyaml/snakeyaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-22T14:02:33Z/ Found at https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47081
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-22T14:02:33Z/ Found at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47081
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-38752
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://security.gentoo.org/glsa/202305-28
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-22T14:02:33Z/ Found at https://security.gentoo.org/glsa/202305-28
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20240315-0009
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20240315-0009/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-22T14:02:33Z/ Found at https://security.netapp.com/advisory/ntap-20240315-0009/
Exploit Prediction Scoring System (EPSS)
Percentile 0.37782
EPSS Score 0.00166
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:05:34.270853+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-9w3m-gqgf-c4p9/GHSA-9w3m-gqgf-c4p9.json 38.0.0