SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
CVE-2022-1471
CRITICALNVD 8.39.0▲Weaponized
EchelonGraph scoreMEDIUM confidence
Score elevated to 9.0 because EPSS predicts 100% probability of exploitation within the next 30 days (top 0.1% of all CVEs). NVD baseline CVSS 8.3 retained for reference. Confidence: see factors.
Triggered by: EPSS exploit prediction ≥85%
Sources: epss, nvd
9.0EG
EchelonGraph verdictPatch this weekExploitation is likely or a public exploit exists.
- High exploitation likelihood — EPSS 100%
- Public exploit code is available (Metasploit, ssvc poc, epss top5pct, epss high, public exploit)
CISA-KEV: Not listedEPSS PROB: 100%CVSS: 8.3Exploit: Metasploit · ssvc poc · epss top5pct · epss high · public exploitExposed: 0
A fix is available — apply it.
- CVSS v3
- 8.3
- EG Score
- 9.0(medium)
- EG Risk
- 80(Track*)EG Risk 80/100SSVC: Track*
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity90% × 45%Exploitation100% × 40%Automatability0% × 15%Action: Watch closely — could escalate to Attend. - EPSS PROB
- 100%
- EPSS %ILE
- 100%
- KEV
- Not listed
Published
December 1, 2022
Last Modified
June 18, 2025
References (20)
- cve-coordination@googlehttp://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
- cve-coordination@googlehttp://www.openwall.com/lists/oss-security/2023/11/19/1
- cve-coordination@googlehttps://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479
- cve-coordination@googlehttps://confluence.atlassian.com/security/cve-2022-1471-snakeyaml-library-rce-vulnerability-in-multiple-products-1296171009.html
- cve-coordination@googlehttps://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
- cve-coordination@googlehttps://github.com/mbechler/marshalsec
- cve-coordination@googlehttps://groups.google.com/g/kubernetes-security-announce/c/mwrakFaEdnc
- cve-coordination@googlehttps://infosecwriteups.com/%EF%B8%8F-inside-the-160-comment-fight-to-fix-snakeyamls-rce-default-1a20c5ca4d4c
- cve-coordination@googlehttps://security.netapp.com/advisory/ntap-20230818-0015/
- cve-coordination@googlehttps://security.netapp.com/advisory/ntap-20240621-0006/
- cve-coordination@googlehttps://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
- af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
- af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/11/19/1
- af854a3a-2127-422b-91ae-364da2661108https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479
- af854a3a-2127-422b-91ae-364da2661108https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
Vendor Advisories for CVE-2022-1471(20)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
- RHSA-2025:1747Red Hat Product SecurityCritical
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update
- RHSA-2025:1746Red Hat Product SecurityCritical
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update
- RHSA-2024:1353Red Hat Product SecurityHigh
Red Hat Security Advisory: Red Hat Process Automation Manager 7.13.5 security update
- RHSA-2024:0775Red Hat Product SecurityHigh
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- RHSA-2024:0325Red Hat Product SecurityHigh
Red Hat Security Advisory: Updated RHEL-7-based Middleware container images
- RHSA-2023:6171Red Hat Product SecurityCritical
Red Hat Security Advisory: Red Hat Product OCP Tools 4.11 Openshift Jenkins security update
- RHSA-2023:5165Red Hat Product SecurityHigh
Red Hat Security Advisory: Red Hat AMQ Streams 2.5.0 release and security update
- RHSA-2023:4612Red Hat Product SecurityHigh
Red Hat Security Advisory: Red Hat support for Spring Boot 2.7.13 security update
- +12 more
Patch Availability(21)
Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.
Affected Packages
(1 across 1 ecosystem)
Maven(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| org.yaml:snakeyaml | 1.10 ... 1.9 (30 versions) | 2.0 | — |
Weakness Classification(2)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Additional Vendor Advisories
(7)
Vendors that published advisories for this CVE beyond the curated set above. Broader coverage but minimal per-row detail — click through for the original advisory.
- Red HatRHBA-2023:0030IMPORTANT2022-10-13
RHBA-2023:0030 — Important
- Red HatRHSA-2022:9032IMPORTANT2022-10-13
RHSA-2022:9032 — Important
- Red HatRHSA-2022:9058IMPORTANT2022-10-13
RHSA-2022:9058 — Important
- Red HatRHSA-2023:0697IMPORTANT2022-10-13
RHSA-2023:0697 — Important
- Red HatRHSA-2023:0758IMPORTANT2022-10-13
RHSA-2023:0758 — Important
- Red HatRHSA-2023:1516IMPORTANT2022-10-13
RHSA-2023:1516 — Important
- Red HatRHSA-2023:7697IMPORTANT2022-10-13
RHSA-2023:7697 — Important
Data Freshness Timeline
(refreshed 4× in last 7d / 8× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-07-24 14:15 UTCEPSS rescore
- 2026-07-24 14:15 UTCEPSS rescore
- 2026-07-23 02:07 UTCEG score recompute
- 2026-07-22 22:53 UTCEG score recompute
- 2026-07-16 14:19 UTCOSV refresh
- 2026-07-09 19:07 UTCEPSS rescore
- 2026-07-09 19:07 UTCEPSS rescore
- 2026-06-28 12:49 UTCOSV refresh
- 2026-06-15 17:46 UTCEPSS rescore
- 2026-06-10 23:09 UTCOSV refresh
- 2026-06-05 06:09 UTCEPSS rescore
- 2026-06-05 06:09 UTCEPSS rescore
- 2026-05-31 22:29 UTCEPSS rescore
- 2026-05-29 13:42 UTCEPSS rescore
- 2026-05-27 13:39 UTCEPSS rescore
- 2026-05-27 13:39 UTCEPSS rescore
- 2026-05-26 07:17 UTCEPSS rescore
- 2026-05-26 07:17 UTCEPSS rescore
- 2026-05-25 11:22 UTCEG score recompute
- 2026-05-25 11:22 UTCVendor advisory
Publicly available exploits
(3 references)Working exploit code is in the public domain (1 Metasploit module) (2 GitHub PoCs). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.
- Metasploitexploit/multi/http/torchserver_cve_2023_43654✓ verifiedFirst seen Oct 3, 2023
PyTorch Model Server Registration and Deserialization RCE
Open source ↗ - GitHub PoCfalconkei/snakeyaml_cve_pocFirst seen May 8, 2023
SnakeYAML-CVE-2022-1471-POC
Open source ↗ - GitHub PoC1fabunicorn/SnakeYAML-CVE-2022-1471-POCFirst seen Mar 2, 2023
Code for veracode blog
Open source ↗
Related CVEs(same vendor + same CWE)
Same vendor
10 shownredhat
- CVE-2001-0825EG 10.0HIGH
- CVE-2001-1009EG 10.0EPSS p93HIGH
- CVE-2001-0554EG 10.0EPSS p98HIGH
- CVE-2001-1162EG 10.0EPSS p96HIGH
- CVE-2001-0414EG 10.0EPSS p100HIGH
- CVE-2001-0191EG 10.0EPSS p92HIGH
- CVE-2001-0301EG 10.0EPSS p90HIGH
- CVE-2001-0197EG 10.0EPSS p96HIGH
- CVE-2001-0233EG 10.0EPSS p96HIGH
- CVE-2001-0010EG 10.0EPSS p98HIGH
Same CWE
10 shownCWE-20
- CVE-2005-0050EG 10.0EPSS p99HIGH
- CVE-2004-1019EG 10.0EPSS p94HIGH
- CVE-2004-0840EG 10.0EPSS p98HIGH
- CVE-2003-1425EG 10.0EPSS p96HIGH
- CVE-2003-1487EG 10.0EPSS p94HIGH
- CVE-2002-1874EG 10.0HIGH
- CVE-2002-2236EG 10.0EPSS p91HIGH
- CVE-2002-2365EG 10.0HIGH
- CVE-2002-1358EG 10.0EPSS p92HIGH
- CVE-2002-1359EG 10.0EPSS p100HIGH
Frequently asked(5)
What is CVE-2022-1471?
CVE-2022-1471 is a critical vulnerability published on December 1, 2022. SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization.…
When was CVE-2022-1471 disclosed?
CVE-2022-1471 was first published in the National Vulnerability Database on December 1, 2022, with the most recent update on June 18, 2025. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2022-1471 actively exploited?
CVE-2022-1471 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 100% probability of exploitation in the next 30 days, which ranks it in the top 0.1% of all scored CVEs.
What is the CVSS score of CVE-2022-1471?
CVE-2022-1471 has a CVSS v3 base score of 8.3 (NVD). EchelonGraph synthesises NVD + CISA KEV + FIRST EPSS + GHSA into a combined EG score of 9.0.
How do I remediate CVE-2022-1471?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2022-1471, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2022-1471
Is Your Infrastructure Affected by CVE-2022-1471?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.