Repository navigation
[T2.11] SnakeYAML 2.6 hardening (8 CVEs) #236
Description
Summary
SnakeYAML 2.7+ requires Java 11+; the 8 catalogued CVEs are pinned at the latest Java 1.8 line. Mitigation: javafaker removed (closing 16 transitive snakeyaml 1.x CVEs); 2.6 line CVEs mitigated via SafeConstructor + setAllowUnknownTags(false). Closing PRs: #99 (issue #98), #101.
Mitigation matrix
See docs/SECURITY-MITIGATIONS.md T2.11 entry.
Closing evidence
docs/SECURITY-MITIGATIONS.mdT2.11 entryowasp-suppressions.xml- Merged PRs: fix(security): T2.x hardening: drop javafaker in SecureStringUtils (closes 16 SnakeYAML CVEs) (issue #98) #99, fix(security): T2.x.2 hardening: drop test-scope javafaker (fully removes snakeyaml 1.x) (issue #100) #101
Activity
docs(security): bulk backfill owasp-suppressions.xml + SECURITY-MITIG…
fix(security): T2.14 hardening: Hibernate ORM 5.6.15 + Validator 6.2.…
natechadwick-intsof commentedon Sep 17, 2026
Closing this sub-task
Closing in bulk as part of the epic #73 wrap-up. All closing evidence for this sub-task is on
main:docs/SECURITY-MITIGATIONS.mdhas the per-GAV mitigation table for this sub-taskowasp-suppressions.xmlhas per-GAV<suppress>entries with<notes>describing the mitigation, pointing back at this issue and the merged PR(s)No outstanding action items for this sub-task on the Java 1.8 line. Residual CVEs (if any) close on the Java 11+ migration epic.