GCVE - cpe:2.3:a:esotericsoftware:yamlbeans:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:esotericsoftware:yamlbeans:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Esotericsoftware (`c0eee686-ff44-532c-a308-67bf65f1e249`)
Product	Yamlbeans (`eaa0edf1-80e7-56da-85f5-2ccea5b88624`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL	Source	Last updated
`pkg:github/esotericsoftware/yamlbeans`	purl2cpe	2026-06-01 10:17:04.591013
`pkg:maven/com.esotericsoftware.yamlbeans/yamlbeans`	purl2cpe	2026-06-01 10:17:04.591015
`pkg:sourceforge/yamlbeans`	purl2cpe	2026-06-01 10:17:04.591018

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-24621`	vulnerable	2026-06-08 05:56:06.168653	Details available An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed. Published: 2023-08-25T00:00:00.000Z Updated: 2024-10-02T18:06:24.584Z Open on db.gcve.eu Reference links https://github.com/EsotericSoftware https://contrastsecurity.com https://github.com/Contrast-Security-OSS/yamlbeans/blob/main/SECURITY.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-24620`	vulnerable	2026-06-08 05:56:06.168218	Details available An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size, causing CPU and memory consumption, such as a Java Out-of-Memory exception. Published: 2023-08-25T00:00:00.000Z Updated: 2024-10-02T18:08:16.309Z Open on db.gcve.eu Reference links https://github.com/EsotericSoftware https://contrastsecurity.com https://github.com/Contrast-Security-OSS/yamlbeans/blob/main/SECURITY.md	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.