CVE-2022-3064 — Uncontrolled Resource Consumption in Yaml.v2 Gopkg.in Yaml.v2

CWE-400 — Uncontrolled Resource Consumption10 documents7 sources
Severity
7.5HIGHNVD
OSV5.5
EPSS
2.2%
top 15.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Gopkg.in Yaml.v2 Gopkg.in Yaml.v2Gopkg.in Yaml.v2Yaml Project Yaml+5 more
Timeline
PublishedDec 27
Latest updateAug 14

Description

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages8 packages

▶Gogopkg.in/yaml.v2< 2.2.4
▶NVDyaml_project/yaml< 2.2.4
▶debiandebian/golang-yaml.v2< golang-yaml.v2 2.2.8-1 (bookworm)

Patches

Patch: github.com ↗Patch: pkg.go.dev ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
golang-yaml.v2 vulnerabilities↗2023-08-14
▶
GHSA
yaml package for Go can consume excessive amounts of CPU or memory↗2022-12-28
▶
OSV
yaml package for Go can consume excessive amounts of CPU or memory↗2022-12-28
▶
OSV
CVE-2022-3064: Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory↗2022-12-27
▶
OSV
Excessive resource consumption in gopkg.in/yaml.v2↗2022-08-29
▶

📋Vendor Advisories

4
Ubuntu
Go yaml vulnerabilities↗2023-08-14
▶
Microsoft
Excessive resource consumption in gopkg.in/yaml.v2↗2022-12-13
▶
Red Hat
go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents↗2022-08-29
▶
Debian
CVE-2022-3064: golang-yaml.v2 - Parsing malicious or large YAML documents can consume excessive amounts of CPU o...↗2022
▶
CVE-2022-3064 — Uncontrolled Resource Consumption | cvebase