Yaml Project

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

Yaml Project records in CISA KEV

No Yaml Project vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

4 records in Yaml · all components

TI-2023-02110 CVE-2023-2251 · GHSA-f9xv-q969-pqx4

HIGH 72

Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01093 Published 2023-04-24 Fixed in 2.0.0-5, 2.2.2 CWE-248

TI-2021-03095 CVE-2021-4235 · GHSA-r88r-gmrh-7j83

MEDIUM 58

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00427 Published 2022-12-27 Partial fix · 2.2.3

TI-2022-11545 CVE-2022-28948 · GHSA-hp87-p4gw-j4gq

MEDIUM 40

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03965 Published 2022-05-19 Partial fix · 3.0.1 CWE-502

TI-2022-02826 CVE-2022-3064 · GHSA-6q6q-88xp-6f2r

LOW 37

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01871 Published 2022-12-27 Partial fix · 2.2.4 CWE-400