diff --git a/CHANGES.txt b/CHANGES.txt
index a990fb0046..289d4e8224 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -18,6 +18,7 @@
  * NPE thrown while updating speculative execution time if keyspace is removed during task execution (CASSANDRA-15949)
  * Show the progress of data streaming and index build (CASSANDRA-15406)
  * Add flag to disable chunk cache and disable by default (CASSANDRA-16036)
+ * Upgrade to snakeyaml >= 1.26 version for CVE-2017-18640 fix (CASSANDRA-16150)
 Merged from 3.11:
  * Fix memory leak in CompressedChunkReader (CASSANDRA-15880)
  * Don't attempt value skipping with mixed version cluster (CASSANDRA-15833)
diff --git a/build.xml b/build.xml
index 6a3eb1eab3..e026630aa0 100644
--- a/build.xml
+++ b/build.xml
@@ -583,8 +583,7 @@
           <dependency groupId="com.googlecode.json-simple" artifactId="json-simple" version="1.1"/>
           <dependency groupId="com.boundary" artifactId="high-scale-lib" version="1.0.6"/>
           <dependency groupId="com.github.jbellis" artifactId="jamm" version="${jamm.version}"/>
-
-          <dependency groupId="org.yaml" artifactId="snakeyaml" version="1.23"/>
+          <dependency groupId="org.yaml" artifactId="snakeyaml" version="1.26"/>
           <dependency groupId="junit" artifactId="junit" version="4.12" />
           <dependency groupId="org.mockito" artifactId="mockito-core" version="3.2.4" />
           <dependency groupId="org.quicktheories" artifactId="quicktheories" version="0.25" />
diff --git a/lib/snakeyaml-1.23.jar b/lib/snakeyaml-1.23.jar
deleted file mode 100644
index adcef4f72c..0000000000
Binary files a/lib/snakeyaml-1.23.jar and /dev/null differ
diff --git a/lib/snakeyaml-1.26.jar b/lib/snakeyaml-1.26.jar
new file mode 100644
index 0000000000..8f301fd042
Binary files /dev/null and b/lib/snakeyaml-1.26.jar differ