CVE-2017-5950: The SingleDocParser::HandleNode function in yaml-cpp (aka LibYaml-C++) 0.5.3 allows remote attackers to cau...

Security readout for executives and security teams

CVE-2017-5950 is a denial-of-service issue in yaml-cpp 0.5.3. A crafted YAML file can exhaust stack space and crash an application that parses it. Business risk depends on whether any internet-facing or customer-facing workflow accepts YAML and processes it with this library version. Exposure is most likely in C++ applications or embedded products that use yaml-cpp 0.5.3 to parse YAML from users, partners, uploads, APIs, repositories, or configuration channels. Internal-only parsing lowers urgency, but batch services can still be disrupted. Treat this as a targeted availability risk, not confirmed data theft or code execution. Prioritize systems where YAML input crosses a customer, partner, or internet boundary. If usage is limited to trusted local configuration, handle through normal dependency remediation. Mitigation focus: Inventory applications and appliances that include yaml-cpp or LibYaml-C++ 0.5.3.; Check yaml-cpp maintainer guidance for fixed versions or recommended remediation.; Avoid parsing untrusted YAML with vulnerable builds until remediated..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.