RHLW-2026-48331bcb39d8ac49

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-48331bcb39d8ac49.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-48331bcb39d8ac49.json
JSON Data
https://api.osv.dev/v1/vulns/RHLW-2026-48331bcb39d8ac49
Upstream
CVE (2)
GHSA (2)
Published
2026-11-13T11:21:18Z
Modified
2026-11-13T18:58:15Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Lightwell Security Advisory: yamlbeans 1.13.0.rhlw-00005
Details

Red Hat Lightwell has released com.esotericsoftware.yamlbeans:yamlbeans 1.13.0.rhlw-00005 with backported fixes for CVE-2023-24620 and CVE-2023-24621.

CVE-2023-24620: An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size, causing CPU and memory consumption, such as a Java Out-of-Memory exception.

CVE-2023-24621: An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.

This patched artifact is a drop-in replacement for com.esotericsoftware.yamlbeans:yamlbeans 1.13.0 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / com.esotericsoftware.yamlbeans:yamlbeans

Package

Name
com.esotericsoftware.yamlbeans:yamlbeans
Purl
pkg:maven/com.esotericsoftware.yamlbeans/yamlbeans

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.13.0.rhlw-00005

Affected versions

1.*
1.06
1.08
1.09
1.11
1.12
1.13
1.13.0

Database specific

lightwell 
{
    "backport_base_version": "1.13.0",
    "remediated_version": "1.13.0.rhlw-00005",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-48331bcb39d8ac49.json"