CVE-2023-24620

An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size, causing CPU and memory consumption, such as a Java Out-of-Memory exception.

• CWE-611

• https://contrastsecurity.comThird Party Advisory
• https://github.com/Contrast-Security-OSS/yamlbeans/blob/main/SECURITY.mdExploit, Third Party Advisory
• https://github.com/EsotericSoftwareThird Party Advisory
• https://contrastsecurity.comThird Party Advisory
• https://github.com/Contrast-Security-OSS/yamlbeans/blob/main/SECURITY.mdExploit, Third Party Advisory
• https://github.com/EsotericSoftwareThird Party Advisory

Published

Aug 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2461Use after free in OS Inputs in Google Chrome on ChromeOS pri…8.8
• CVE-2023-24610NOSH 4a5cfdb allows remote authenticated users to execute PH…8.8
• CVE-2023-24612The PdfBook extension through 2.0.5 before b07b6a64 for Medi…9.8
• CVE-2023-24613The user interface of Array Networks AG Series and vxAG thro…4.9
• CVE-2023-24619Redpanda before 22.3.12 discloses cleartext AWS credentials.…5.5
• CVE-2023-2462Inappropriate implementation in Prompts in Google Chrome pri…4.3
• CVE-2023-24621An issue was discovered in Esoteric YamlBeans through 1.15. …7.8
• CVE-2023-24622isInList in the safeurl-python package before 1.2 for Python…5.3
• CVE-2023-24623Paranoidhttp before 0.3.0 allows SSRF because [::] is equiva…7.5
• CVE-2023-24625Faveo 5.0.1 allows remote attackers to obtain sensitive info…6.5
• CVE-2023-24626socket.c in GNU Screen through 4.9.0, when installed setuid …6.5
• CVE-2023-2463Inappropriate implementation in Full Screen Mode in Google C…4.3