eemeli yaml up to 1.10.2/2.8.2 YAML Parser parse recursion

Summaryinfo

A vulnerability, which was classified as problematic, was found in eemeli yaml up to 1.10.2/2.8.2. This affects the function parse of the component YAML Parser. Executing a manipulation can lead to recursion. This vulnerability is registered as CVE-2026-33532. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in eemeli yaml up to 1.10.2/2.8.2 and classified as problematic. This vulnerability affects the function parse of the component YAML Parser. The manipulation with an unknown input leads to a recursion vulnerability. The CWE definition for the vulnerability is CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. As an impact it is known to affect availability. CVE summarizes:

`yaml` is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of `yaml` on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a `RangeError: Maximum call stack size exceeded` with a small payload (~2–10 KB). The `RangeError` is not a `YAMLParseError`, so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process. Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one `[` and one `]`). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation). Note: the library's `Parser` (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion. All three public parsing APIs are affected: `YAML.parse()`, `YAML.parseDocument()`, and `YAML.parseAllDocuments()`. Versions 1.10.3 and 2.8.3 contain a patch.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-33532 since 03/20/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 326329 (SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:2824-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.10.3 or 2.8.3 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 1e84ebbea7ec35011a4c61bbb820a529ee4f359b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (326329) and CERT Bund (WID-SEC-2026-1407). Once again VulDB remains the best source for vulnerability data.

Affected

• IBM App Connect Enterprise
• Red Hat Enterprise Linux
• Fedora Linux
• IBM QRadar SIEM
• IBM MQ
• IBM Maximo Asset Management
• IBM Sterling Connect:Direct

Productinfo

Vendor

• eemeli

Name

• yaml

Version

• 1.10.0
• 1.10.1
• 1.10.2
• 2.8.0
• 2.8.1
• 2.8.2

License

• open-source

Website

• Product: https://github.com/eemeli/yaml/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion