Uncontrolled Recursion Affecting biojppm/rapidyaml package, versions [,0.7.0)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-UNMANAGED-BIOJPPMRAPIDYAML-12302090
published2 Sept 2025
disclosed1 Mar 2025
creditUnknown

Report a new vulnerability Found a mistake?

Introduced: 1 Mar 2025

CWE-674 (opens in a new tab)

How to fix?

Upgrade biojppm/rapidyaml to version 0.7.0 or higher.

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion due to a missing maximum tree depth check in emitter functions.

References

CVSS Base Scores

version 4.0

version 3.1

Attack Vector (AV)
Local
Attack Complexity (AC)
Low
Attack Requirements (AT)
None
Privileges Required (PR)
None
User Interaction (UI)
None

Confidentiality (VC)
None
Integrity (VI)
None
Availability (VA)
High

Confidentiality (SC)
None
Integrity (SI)
None
Availability (SA)
None