CVE-2016-8744
Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML…
- Published
- Updated
- Reserved
- Assigned by
- apache
Description
Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the classpath. This could provide an authenticated user with a means to cause the JVM running Brooklyn to load and run Java code without detection by Brooklyn. Such code would have the privileges of the Java process running Brooklyn, including the ability to open files and network connections, and execute system commands. There is known to be a proof-of-concept exploit using this vulnerability.
Timeline
ID reserved
By apache
- 11 months later
· 11 months later
Published
- 7 years later
· 7 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 3.8% · top 9.9% of all CVEs (8 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Weakness
- Remote code execution
- CWE-502 (opens in a new tab)All about CWE-502 and its CVEs
Affected products
Apache Software Foundation · Apache Brooklyn
- affected 0.9.0 and all prior versions
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.apache.brooklyn:brooklynGHSA-9cqh-5x6g-wgm9 (opens in a new tab)
References (2)
- https://brooklyn.apache.org/community/security/CVE-2016-8744.html (opens in a new tab)x_refsource_CONFIRMx_transferred
- [dev] 20170210 [SECURITY] CVE-2016-8744: Apache Brooklyn, SnakeYAML configuration potentially allows remote code execution (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-9cqh-5x6g-wgm9 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2016-8744)Record last updated .