security-audit

lesson

python ruamel-yaml yaml dos billion-laughs security-audit recursionerror

477 tok

ruamel.yaml does not memory-expand billion-laughs aliases; the real DoS vectors are unbounded read and composer RecursionError

ruamel.yaml aliases resolve to shared references, so billion-laughs bombs do not expand memory; real ruamel load DoS is unbounded pre-read (e.g. /dev/zero) and composer RecursionError on deep nesting. Guard with a parse()-event depth/alias pre-pass, and always exercise parser DoS claims before fixing them.

@mahmoud