CVE-2022-1471

CRITICALNVD 8.39.0▲
EchelonGraph scoreHIGH confidence

Score elevated to 9.0 because EPSS predicts 100% probability of exploitation within the next 30 days (99th percentile of EPSS-scored CVEs). NVD baseline CVSS 8.3 retained for reference. Confidence: see factors.

Triggered by: EPSS exploit prediction (continuous uplift above 30%)
Sources: epss, nvd
Weaponized
9.0EG
EchelonGraph verdictPatch this weekExploitation is likely or a public exploit exists.
  • High exploitation likelihood — EPSS 100%
  • Public exploit code is available (Metasploit, ssvc poc, epss top5pct, epss high, public exploit)
CISA-KEV: Not listedEPSS PROB: 100%CVSS: 8.3Exploit: Metasploit · ssvc poc · epss top5pct · epss high · public exploitExposed services: Not assessed

A fix is available — apply it.

SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

CVSS v3
8.3
EG Score
9.0CRITICALhigh confidence
EG Risk
80
EG Risk 80/100CISA SSVC

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity90% × 45%
Exploitation100% × 40%
Automatability0% × 15%
CISA SSVC: Track at low, Track* at medium and Attend at high mission impact.
Action: A fix is available. Apply it within your standard update timelines at low or medium mission impact and sooner than that at high.
EPSS PROB
100%
EPSS %ILE
99th
KEV
Not listed

CISA SSVCTrack at low, Track* at medium and Attend at high mission impact.

A fix is available. Apply it within your standard update timelines at low or medium mission impact and sooner than that at high.

Exploitation public PoC (CISA Vulnrichment) · Automatable no (CISA Vulnrichment) · Technical impact total (CISA Vulnrichment). Mission impact is CISA's Mission & Well-being decision point, and only you can judge it: high means the affected system is essential to your organisation's mission, or its compromise could cause irreversible harm to people. CISA's decision table

Published

December 1, 2022

Last Modified

June 18, 2025

Advisory Details (8)

Auto-updated Sep 6, 2026
🔬 Proof of concept available. Patch available. Sources: github.
generic

NetApp Product Security

https://security.netapp.com/advisory/ntap-20240621-0006/
generic

NetApp Product Security

https://security.netapp.com/advisory/ntap-20230818-0015/
generic
https://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
generic

GitHub - mbechler/marshalsec · GitHub

https://github.com/mbechler/marshalsec
githubMentions a patch (unverified)🟡 PoC Available

SnakeYaml: Constructor Deserialization Remote Code Execution · Advisory · google/security-research · GitHub

https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
generic

CVE-2022-1471 - SnakeYAML library RCE Vulnerability impacts Multiple Products | Atlassian Support | Atlassian Documentation

https://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html
generic

oss-security - CVE-2023-46302: Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization

http://www.openwall.com/lists/oss-security/2023/11/19/1
generic

Locked Out | Packet Storm

http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html

Vendor Advisories for CVE-2022-1471(20)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Patch Availability(21)

Vendor / EcosystemFix (by version range) / PatchReleasedSource
redhateap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.ep7.el72025-02-24redhat
redhateap7-snakeyaml-0:1.33.0-1.SP1_redhat_00001.1.el7eap2025-02-24redhat
redhatsnakeyaml2024-03-18redhat
redhatjenkins-2-plugins-0:4.11.1706516946-1.el82024-02-12redhat
redhatredhat-openjdk-18/openjdk18-openshift:1.17-12024-01-22redhat
redhatjenkins-2-plugins-0:4.11.1698299029-1.el82023-10-30redhat
redhatpatch2023-09-14redhat
redhatjenkins-2-plugins-0:4.11.1683009941-1.el82023-05-17redhat
redhatcandlepin-0:4.2.13-1.el8sat2023-05-03redhat
redhateap7-snakeyaml-0:1.33.0-2.SP1_redhat_00001.1.el9eap2023-03-29redhat
redhateap7-snakeyaml-0:1.33.0-2.SP1_redhat_00001.1.el8eap2023-03-29redhat
redhateap7-snakeyaml-0:1.33.0-2.SP1_redhat_00001.1.el7eap2023-03-29redhat
redhatrh-sso-7/sso76-openshift-rhel8:7.6-202023-03-01redhat
redhatrh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso2023-03-01redhat
redhatrh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso2023-03-01redhat
redhatrh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8sso2023-03-01redhat
redhatjenkins-2-plugins-0:4.9.1675668922-1.el82023-02-23redhat
redhatjenkins-2-plugins-0:4.10.1675407676-1.el82023-02-15redhat
redhatpatch2023-02-14redhat
redhatubi8/openjdk-8-runtime:1.14-102023-01-04redhat
redhatprometheus-jmx-exporter-0:0.12.0-9.el8_72022-12-15redhat

Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.

Affected Packages

(5 across 5 ecosystems)
Debian:11(1)
PackageVulnerable rangeFix by version rangeDependents
snakeyaml1.28-1 ... 2.5+ds-1~exp0 (12 versions)
  • every version on: no fix on record
—
Debian:12(1)
PackageVulnerable rangeFix by version rangeDependents
snakeyaml1.33-2 ... 2.5+ds-1~exp0 (6 versions)
  • every version on: no fix on record
—
Debian:13(1)
PackageVulnerable rangeFix by version rangeDependents
snakeyaml2.0+ds+really1.33-1, 2.4+ds-1~exp0, 2.5+ds-1, 2.5+ds-1~exp0
  • every version on: no fix on record
—
Debian:14(1)
PackageVulnerable rangeFix by version rangeDependents
snakeyaml2.0+ds+really1.33-1, 2.4+ds-1~exp0, 2.5+ds-1, 2.5+ds-1~exp0
  • every version on: no fix on record
—
Maven(1)
PackageVulnerable rangeFix by version rangeDependents
org.yaml:snakeyaml1.10 ... 1.9 (30 versions)
  • every version up to 2.0: fixed in 2.0
—

Weakness Classification(2)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Additional Vendor Advisories

(7)

Vendors that published advisories for this CVE beyond the curated set above. Broader coverage but minimal per-row detail — click through for the original advisory.

Data Freshness Timeline

(refreshed 0× in last 7d / 7× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-10-02 16:23 UTCEPSS rescore
  2. 2026-09-30 15:47 UTCEG score recompute
  3. 2026-09-24 14:00 UTCEPSS rescore
  4. 2026-09-24 14:00 UTCEPSS rescore
  5. 2026-09-24 05:15 UTCOSV refresh
  6. 2026-09-16 14:05 UTCEPSS rescore
  7. 2026-09-16 14:05 UTCEPSS rescore
  8. 2026-09-05 15:25 UTCEPSS rescore
  9. 2026-09-04 22:24 UTCOSV refresh
  10. 2026-08-30 19:14 UTCEPSS rescore
  11. 2026-08-30 01:19 UTCEPSS rescore
  12. 2026-08-24 14:13 UTCEPSS rescore
  13. 2026-08-18 09:34 UTCOSV refresh
  14. 2026-08-12 13:48 UTCEPSS rescore
  15. 2026-08-03 04:57 UTCOSV refresh
  16. 2026-07-24 14:15 UTCEPSS rescore
  17. 2026-07-24 14:15 UTCEPSS rescore
  18. 2026-07-23 02:07 UTCEG score recompute
  19. 2026-07-22 22:53 UTCEG score recompute
  20. 2026-07-16 14:19 UTCOSV refresh
  21. 2026-07-09 19:07 UTCEPSS rescore
  22. 2026-07-09 19:07 UTCEPSS rescore
  23. 2026-06-28 12:49 UTCOSV refresh
  24. 2026-06-15 17:46 UTCEPSS rescore
  25. 2026-06-10 23:09 UTCOSV refresh
Show 10 more
  1. 2026-06-05 06:09 UTCEPSS rescore
  2. 2026-06-05 06:09 UTCEPSS rescore
  3. 2026-05-31 22:29 UTCEPSS rescore
  4. 2026-05-29 13:42 UTCEPSS rescore
  5. 2026-05-27 13:39 UTCEPSS rescore
  6. 2026-05-27 13:39 UTCEPSS rescore
  7. 2026-05-26 07:17 UTCEPSS rescore
  8. 2026-05-26 07:17 UTCEPSS rescore
  9. 2026-05-25 11:22 UTCEG score recompute
  10. 2026-05-25 11:22 UTCVendor advisory

Publicly available exploits

(3 references)

Working exploit code is in the public domain (1 Metasploit module) (2 GitHub PoCs). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.

  • Metasploitexploit/multi/http/torchserver_cve_2023_43654✓ verified
    First seen Oct 3, 2023

    PyTorch Model Server Registration and Deserialization RCE

    Open source ↗
  • GitHub PoCfalconkei/snakeyaml_cve_poc
    First seen May 8, 2023

    SnakeYAML-CVE-2022-1471-POC

    Open source ↗
  • GitHub PoC1fabunicorn/SnakeYAML-CVE-2022-1471-POC
    First seen Mar 2, 2023

    Code for veracode blog

    Open source ↗

Related CVEs(same product + same vendor + same CWE)

Frequently asked(5)

What is CVE-2022-1471?
CVE-2022-1471 is a critical vulnerability published on December 1, 2022. SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization.…
When was CVE-2022-1471 disclosed?
CVE-2022-1471 was first published on December 1, 2022, with the most recent update on June 18, 2025. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2022-1471 actively exploited?
CVE-2022-1471 is not currently on CISA's Known Exploited Vulnerabilities catalog. EchelonGraph's EG-KEV model classifies it as weaponized: a functional public exploit exists. FIRST EPSS estimates a 100% probability of exploitation in the next 30 days (99th percentile of EPSS-scored CVEs).
What is the CVSS score of CVE-2022-1471?
CVE-2022-1471 has a CVSS v3 base score of 8.3 (NVD). EchelonGraph synthesises NVD + CISA KEV + FIRST EPSS + GHSA into a combined EG score of 9.0 (CRITICAL).
How do I remediate CVE-2022-1471?
A fix for CVE-2022-1471 is available: update to the fixed version the vendor names in its advisory. The vendor advisories EchelonGraph has for CVE-2022-1471 are linked in the Vendor Advisories panel on this page.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2022-1471

Explore →

Is Your Infrastructure Affected by CVE-2022-1471?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Book a Demo →Browse All CVEs