yaml is vulnerable to Denial of Service (DoS) attacks. According to the documentation, the parseDocument
and parseAllDocuments
functions should never raise an exception. However, an exception that comes from the prettifyError
function is thrown when these functions are given erroneous input that contains a lot (80) of carriage return characters (\r
), which allows an attacker to cause an application crash.