CVE-2018-20573: The Scanner::EnsureTokensInQueue function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to ca...

Security readout for executives and security teams

CVE-2018-20573 is a denial-of-service flaw in yaml-cpp 0.6.2. A specially crafted YAML file can exhaust stack space and crash an application that parses it. Business urgency depends on whether internet-facing or partner-facing systems accept YAML input using this library. Exposure is most likely in applications embedding yaml-cpp 0.6.2 that parse YAML from users, partners, APIs, files, or automation pipelines. The provided sources do not identify downstream products or package ecosystems beyond yaml-cpp itself. Prioritize if YAML parsing is exposed in production services where crashes would disrupt customers or operations. If usage is internal-only or absent, urgency is lower. The evidence supports availability risk, not data theft or code execution. Mitigation focus: Inventory applications and services that include yaml-cpp 0.6.2.; Check yaml-cpp upstream and vendor package guidance for patches or fixed versions.; Limit acceptance of untrusted YAML where operationally possible..

Prepared

Jun 6, 2026, 22:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.