gopkg.in/yaml.v3 Denial of Service · CVE-2022-28948 · GitHub Advisory Database · GitHub

gopkg.in/yaml.v3 Denial of Service

High severity GitHub Reviewed Published May 20, 2022 to the GitHub Advisory Database • Updated May 20, 2024

Package

gopkg.in/yaml.v3 (Go)

Affected versions

< 3.0.0-20220521103104-8f96da9f5d5e

Patched versions

3.0.0-20220521103104-8f96da9f5d5e

Description

An issue in the Unmarshal function in Go-Yaml v3 can cause a program to panic when attempting to deserialize invalid input.

References

Published by the National Vulnerability Database

May 19, 2022

Published to the GitHub Advisory Database May 20, 2022

Reviewed May 25, 2022

Last updated May 20, 2024

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H