Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-07-08T15:15:54
js-yaml: js-yaml: Denial of Service via crafted YAML documents
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.
A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.
This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.
To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.
Red Hat Hardened Images
2026-07-10T00:00:00Z
RHSA-2026:37532
nodejs26-main-26.4.0-1.4.hum1
Red Hat Hardened Images
2026-07-10T00:00:00Z
RHSA-2026:37534
nodejs25-main-25.9.0-1.3.hum1
Red Hat Hardened Images
2026-07-10T00:00:00Z
RHSA-2026:37577
dotnet8-0-main-8.0.128-1.1.hum1
Red Hat Hardened Images
2026-07-11T00:00:00Z
RHSA-2026:38187
rust-main-1.97.0-1.1.hum1
Red Hat Hardened Images
2026-07-11T00:00:00Z
RHSA-2026:38236
nodejs24-main-24.18.0-0.3.hum1
Red Hat Hardened Images
2026-07-12T00:00:00Z
RHSA-2026:38304
nodejs22-main-22.23.1-2.1.hum1
Cryostat 4
Under investigation
cryostat/cryostat-openshift-console-plugin-rhel9
Cryostat 4
Under investigation
cryostat-openshift-console-plugin-npm
Cryostat 4
Under investigation
grafana-infinity-datasource-npm
Cryostat 4
Affected
js-yaml
Gatekeeper 3
Not affected
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Applications 8
Under investigation
mta/mta-ui-rhel8
Migration Toolkit for Applications 8
Under investigation
mta/mta-ui-rhel9
Migration Toolkit for Containers
Affected
rhmtc/openshift-migration-ui-rhel8
Multicluster Engine for Kubernetes
Affected
multicluster-engine/console-mce-rhel9
Network Observability Operator
Affected
network-observability/network-observability-console-plugin-pf5-rhel9
Network Observability Operator
Affected
network-observability/network-observability-console-plugin-rhel9
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-must-gather-rhel9
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-operator-bundle
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-rhel9-operator
Node HealthCheck Operator
Affected
workload-availability/node-remediation-console-rhel8
Node HealthCheck Operator
Affected
workload-availability/node-remediation-console-rhel9
OpenShift Lightspeed
Affected
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Affected
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Affected
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-console-plugin-rhel8
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Affected
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Affected
openshift-service-mesh/kiali-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9-operator
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp21/system
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp22/system
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel7
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel8
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Affected
rhacm2/console-rhel9
Red Hat Advanced Cluster Security 4
Affected
advanced-cluster-security/rhacs-main-rhel8
Red Hat Advanced Cluster Security 4
Affected
advanced-cluster-security/rhacs-main-rhel9
Red Hat AMQ Broker 7
Affected
js-yaml
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-24/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-25/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-26/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-27/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-27/mcp-server-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-tech-preview/mcp-server-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
automation-controller
Red Hat Ansible Automation Platform 2
Under investigation
automation-eda-controller
Red Hat Ansible Automation Platform 2
Under investigation
automation-gateway
Red Hat Ansible Automation Platform 2
Under investigation
automation-platform-ui
Red Hat build of Apache Camel for Spring Boot 4
Affected
js-yaml
Red Hat build of Apache Camel - HawtIO 4
Affected
js-yaml
Red Hat build of Apicurio Registry 3
Affected
apicurio/apicurio-registry-ui-rhel8
Red Hat build of Apicurio Registry 3
Affected
apicurio/apicurio-registry-ui-rhel9
Red Hat Build of Keycloak
Affected
js-yaml
Red Hat Build of Podman Desktop
Affected
rh-podman-desktop.git
Red Hat Ceph Storage 9
Affected
rhceph/alloy-rhel10
Red Hat Connectivity Link 1
Affected
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Data Grid 8
Affected
js-yaml
Red Hat Developer Hub
Affected
rhdh/rhdh-hub-rhel9
Red Hat Directory Server 11
Under investigation
redhat-ds:11/389-ds-base
Red Hat Directory Server 12
Under investigation
redhat-ds:12/389-ds-base
Red Hat Directory Server 13
Under investigation
389-ds-base
Red Hat Discovery 2
Under investigation
discovery/discovery-ui-rhel9
Red Hat Edge Manager 1
Affected
rhem/flightctl-ui-ocp-rhel10
Red Hat Edge Manager 1
Affected
rhem/flightctl-ui-ocp-rhel9
Red Hat Edge Manager 1
Affected
rhem/flightctl-ui-rhel10
Red Hat Edge Manager 1
Affected
rhem/flightctl-ui-rhel9
Red Hat Enterprise Linux 10
Under investigation
grafana
Red Hat Enterprise Linux 10
Under investigation
rust
Red Hat Enterprise Linux 7
Under investigation
subscription-manager
Red Hat Enterprise Linux 8
Under investigation
grafana
Red Hat Enterprise Linux 8
Under investigation
mozjs60
Red Hat Enterprise Linux 8
Under investigation
pcs
Red Hat Enterprise Linux 9
Under investigation
gjs
Red Hat Enterprise Linux 9
Under investigation
grafana
Red Hat Enterprise Linux 9
Under investigation
pcs
Red Hat Enterprise Linux 9
Under investigation
rust
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/disk-image-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rust
Red Hat Hardened Images
Affected
nodejs20
Red Hat Hardened Images
Not affected
yarnpkg
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
js-yaml
Red Hat JBoss Enterprise Application Platform 8
Affected
js-yaml
Red Hat JBoss Enterprise Application Platform Expansion Pack
Affected
js-yaml
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/nmstate-console-plugin-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-monitoring-plugin-rhel8
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-monitoring-plugin-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Affected
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/code-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/dashboard-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/openvsx-rhel9
Red Hat OpenShift GitOps
Affected
openshift-gitops-1/argocd-rhel8
Red Hat OpenShift GitOps
Affected
openshift-gitops-1/argocd-rhel9
Red Hat OpenShift Virtualization 4
Affected
container-native-virtualization/kubevirt-console-plugin
Red Hat OpenShift Virtualization 4
Affected
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Quay 3
Affected
quay/quay-rhel8
Red Hat Quay 3
Affected
quay/quay-rhel9
Red Hat Satellite 6
Under investigation
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Under investigation
satellite/iop-remediations-rhel9
Red Hat Single Sign-On 7
Fix deferred
js-yaml
Red Hat Trusted Artifact Signer
Affected
rhtas/rekor-search-ui-rhel9
Red Hat Trusted Artifact Signer
Affected
rhtas/rhtas-console-ui-rhel9
Red Hat Trusted Profile Analyzer
Affected
rhtpa/rhtpa-trustification-service-rhel9
Secrets Management Console for Red Hat OpenShift
Affected
external-secrets-management/console-plugin-rhel9
Self-service automation portal 2
Under investigation
ansible-automation-platform/automation-portal
Self-service automation portal 2
Under investigation
ansible-automation-platform/bootc-automation-portal-rhel9
streams for Apache Kafka 2
Affected
js-yaml
streams for Apache Kafka 3
Affected
js-yaml
https://www.cve.org/CVERecord?id=CVE-2026-59869
https://nvd.nist.gov/vuln/detail/CVE-2026-59869
https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4
https://github.com/nodeca/js-yaml/releases/tag/3.15.0
https://github.com/nodeca/js-yaml/releases/tag/4.3.0
https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m