diff --git a/SPECS/prometheus-jmx-exporter.spec b/SPECS/prometheus-jmx-exporter.spec
index e0e6e7e..0d8e2b9 100644
--- a/SPECS/prometheus-jmx-exporter.spec
+++ b/SPECS/prometheus-jmx-exporter.spec
@@ -10,7 +10,7 @@
 
 Name:           prometheus-jmx-exporter
 Version:        0.12.0
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        Prometheus JMX Exporter
 
 License:        ASL 2.0
@@ -36,7 +36,7 @@ BuildRequires: mvn(io.prometheus:simpleclient_httpserver)
 
 Provides: bundled(io.prometheus.jmx:collector) = %{version}
 Provides: bundled(io.prometheus:simpleclient) = %{simple_client_version}
-Provides: bundled(org.yaml:snakeyaml) = 1.26
+Provides: bundled(org.yaml:snakeyaml) = 1.32
 Provides: bundled(biz.source_code:base64coder) = 2010.12.19
 Provides: bundled(commons-codec:commons-codec) = 1.11
 Provides: bundled(io.prometheus:simpleclient_hotspot) = %{simple_client_version}
@@ -118,6 +118,9 @@ OpenJDK 17 binding package for %{name}
 # empty files for the binding package
 
 %changelog
+* Mon Sep 26 2022 Jonathan Dowland <jdowland@redhat.com> - 0.12.0-8
+- Bump snakeyaml version to 1.32 to collect fix for CVE-2022-25857
+  (BZ 2128477)
 * Tue Aug 31 2021 Severin Gehwolf <sgehwolf@redhat.com> - 0.12.0-7
 - Add JDK binding sub-packages so that the package
   can be used with either JDK 11 or JDK 17.