CVE-2023-2251 Uncaught Exception in eemeli/yaml
An attacker can cause a denial of service by triggering an uncaught exception in the YAML parser library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-2251?
CVE-2023-2251 is a high-severity denial of service vulnerability in eemeli/yaml, published on 24 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.
Weakness: CWE-248
Which versions are affected by CVE-2023-2251?
2 open source packages ship an affected version, including yaml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yaml npm | From 2.0.0-5 | 2.2.2 |
yaml npm | From 2.0.0-5 | 2.2.2 |
Linux distribution packages (1)
element-web openSUSE:Tumbleweed | All versions | 1.11.30-2.1 |
Products include Yaml Project Yaml.
How do I fix CVE-2023-2251?
Upgrade yaml to 2.2.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-2251 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-2251 exists.
Other vulnerabilities in eemeli/yaml
Sources
Also known as DEBIAN-CVE-2023-2251, GHSA-f9xv-q969-pqx4, ROOT-APP-NPM-CVE-2023-2251, UBUNTU-CVE-2023-2251, openSUSE-SU-2024:12888-1.