https://pok3.xyz/tags/denial-of-service/Recent content in Denial-of-Service on pok3 // security notesHugoen-usSun, 27 Sep 2026 15:13:38 -0400https://pok3.xyz/posts/parsing-yaml-is-a-minefield/Sun, 27 Sep 2026 15:13:38 -0400https://pok3.xyz/posts/parsing-yaml-is-a-minefield/<p>Not long ago I was researching the behavior of YAML parsing libraries as part of my master&rsquo;s thesis. Since there is a <a href="https://yaml.org/spec/1.2.2/" class="ext" target="_blank" rel="noopener noreferrer">YAML specification</a> , I wanted to assess whether the parsing libraries listed on the official <a href="https://yaml.org/libraries/" class="ext" target="_blank" rel="noopener noreferrer">yaml.org</a> website comply with the current specification. My idea is hugely inspired by Nicolas Seriot&rsquo;s <a href="https://seriot.ch/security/parsing_json.html" class="ext" target="_blank" rel="noopener noreferrer">Parsing JSON is a minefield</a> ^[ <a href="https://seriot.ch/security/parsing_json.html" class="ext" target="_blank" rel="noopener noreferrer">https://seriot.ch/security/parsing_json.html</a> ], which I definitely recommend reading.</p>