CVE-2022-38750: 
Java vulnerability analysis and mitigation

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash by stack overflow. The vulnerability was discovered in April 2022 and was assigned CVE-2022-38750 (CVE Details, NVD).

The vulnerability occurs in the org.yaml.snakeyaml.constructor.BaseConstructor.constructObject component of SnakeYAML versions prior to 1.31. It has been assigned a CVSS score of 5.5 (MEDIUM) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NetApp Advisory).

Successful exploitation of this vulnerability could lead to Denial of Service (DoS) when processing maliciously crafted input files. The vulnerability affects applications that use SnakeYAML to parse untrusted YAML files, potentially causing system crashes through stack overflow (Debian LTS).

The vulnerability was fixed in SnakeYAML version 1.31. Users are advised to upgrade to version 1.31 or later to address this security issue. For systems that cannot be immediately upgraded, there are no known workarounds at this time (Gentoo Security).