CVE-2023-24620

Summary

CVE-2023-24620 is a newly discovered vulnerability in Esoteric YamlBeans versions up to 1.15. The issue allows for XML Entity Expansion attacks against the YamlReader component. A carefully crafted YAML document can cause excessive CPU and memory consumption by exploiting the Anchor feature in YAML. This can result in a Java Out-of-Memory exception. Attackers can take advantage of this vulnerability to launch denial-of-service attacks on affected systems. It is recommended that users update to the latest version of YamlBeans to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.