How severe is CVE-2017-18640?

CVE-2017-18640 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2017-18640 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 27% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-18640?

CVE-2017-18640 primarily affects Snakeyaml Project Snakeyaml. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2017-18640?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2017-18640 published?

CVE-2017-18640 was published on 2019-12-12 and last updated on 2026-06-17.

CVE-2017-18640

CVE-2017-18640 is a high-severity vulnerability in Snakeyaml Project Snakeyaml with a CVSS 3.x base score of 7.5. Its EPSS exploit-prediction score of 27% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-776.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 27% (98th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-776
Affected product: Snakeyaml Project Snakeyaml
Published: 2019-12-12
Last modified: 2026-06-17

Description

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

Frequently asked questions

What is CVE-2017-18640?: The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
How severe is CVE-2017-18640?: CVE-2017-18640 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2017-18640 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 27% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-18640?: CVE-2017-18640 primarily affects Snakeyaml Project Snakeyaml. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2017-18640?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2017-18640 published?: CVE-2017-18640 was published on 2019-12-12 and last updated on 2026-06-17.

References

Affected products (7)

cpe:2.3:a:snakeyaml_project:snakeyaml:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.56:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.57:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_pt_peopletools:8.58:*:*:*:*:*:*:*

More vulnerabilities in Snakeyaml Project Snakeyaml

CVE-2022-1471 — High (CVSS 8.3): SnakeYaml's Constructor() class does not restrict types which can be instantiated during…
CVE-2022-25857 — High (CVSS 7.5): The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested…
CVE-2022-38752 — Medium (CVSS 6.5): Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is…
CVE-2022-38751 — Medium (CVSS 6.5): Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is…
CVE-2022-38750 — Medium (CVSS 6.5): Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is…
CVE-2022-38749 — Medium (CVSS 6.5): Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is…

All CVEs affecting Snakeyaml Project Snakeyaml →

Other CWE-776 vulnerabilities

CVE-2019-19144 — Critical (CVSS 9.8): XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via…
CVE-2022-23640 — Critical (CVSS 9.8): Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to…
CVE-2014-2228 — Critical (CVSS 9.8): The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe…
CVE-2013-4335 — Critical (CVSS 9.8): opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities
CVE-2021-23926 — Critical (CVSS 9.1): The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from…
CVE-2020-24590 — Critical (CVSS 9.1): The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.

Browse all CWE-776 vulnerabilities →