Medium severity5.5NVD Advisory· Published Aug 25, 2023· Updated Jun 17, 2026
CVE-2023-24620
CVE-2023-24620
Description
An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size, causing CPU and memory consumption, such as a Java Out-of-Memory exception.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.esotericsoftware.yamlbeans:yamlbeansMaven | <= 1.15 | — |
Affected products
3- Esoteric/YamlBeansdescription
Patches
Vulnerability mechanics
References
4- github.com/Contrast-Security-OSS/yamlbeans/blob/main/SECURITY.mdnvdExploitThird Party AdvisoryWEB
- contrastsecurity.comnvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-vj49-j7rc-h54fghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-24620ghsaADVISORY
News mentions
0No linked articles in our index yet.