Deserialization of Untrusted Data in org.jboss.resteasy:resteasy-yaml-provider

HIGH 8.1CVE-2018-1051 · GHSA-m2fv-3rqm-g7p5 · Published 25/01/2018 · updated 17/06/2026

In short

CVE-2018-1051 is a HIGH (CVSS 8.1) vulnerability affecting org.jboss.resteasy:resteasy-yaml-provider, resteasy (redhat).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.7% of all vulnerabilities.
Fix: update to 3.6.0.Final, 3.0.26.Final or later.

Package	Affected versions	Patched versions
org.jboss.resteasy:resteasy-yaml-provider Maven	`≥ 3.1.0, < 3.6.0.Final< 3.0.26.Final`	`3.6.0.Final3.0.26.Final`
resteasy redhat	`= 3.0.22= 3.1.2`	No fix yet

Description

It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via Yaml.load() in YamlProvider.

Mitigation:

If the YamlProvider is enabled it's recommended to add authentication, and authorization to the endpoint expecting Yaml content to prevent exploitation of this vulnerability.

NVD description

It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()` in YamlProvider.

References

nvd.nist.gov/vuln/detail/CVE-2018-1051 · ADVISORY
resteasy/resteasy#1555 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
bugzilla.redhat.com/show_bug.cgi · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free