Excessive resource consumption in gopkg.in/yaml.v2
Priority LOW 37CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 17 fixed, 15 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01871 79th percentileScored 2026-11-07
Fix Partial gopkg.in/yaml.v2 (gopkg.in/yaml.v2): 2.2.4gopkg.in/yaml.v2 (Go): 2.2.4Red Hat: 20 advisoriesRed Hat: 17 fixed, 15 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gopkg.in/yaml.v2 | gopkg.in/yaml.v2 | before 2.2.4 | 2.2.4 | Patch available | CNA |
| — | gopkg.in/yaml.v2 (Go) | before 2.2.4 | 2.2.4 | Patch available | GHSA-6q6q-88xp-6f2r |
- gopkg.in/yaml.v2 Vendorgopkg.in/yaml.v2 Affected before 2.2.4 Fixed in 2.2.4 Patch available CNA
- gopkg.in/yaml.v2 (Go) Vendor— Affected before 2.2.4 Fixed in 2.2.4 Patch available GHSA-6q6q-88xp-6f2r
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:yaml_project:yaml:*:*:*:*:*:go:*:* | before 2.2.4 | Vulnerable | Yaml Project |
- cpe:2.3:a:yaml_project:yaml:*:*:*:*:*:go:*:* Versions before 2.2.4 Vulnerable ·Yaml Project
Remediation
- Fix · CNA gopkg.in/yaml.v2 (gopkg.in/yaml.v2) Fixed in 2.2.4
- Fix · GHSA-6q6q-88xp-6f2r gopkg.in/yaml.v2 (Go) Fixed in 2.2.4 Advisory →
Red Hat 20 advisories
- RHSA-2024:10784 Released 2024-12-04 · Red Hat rating Moderaterhc security update
- Red Hat Enterprise Linux AppStream (v. 8) rhc-1:0.2.5-1.el8_10
- RHSA-2024:10759 Released 2024-12-03 · Red Hat rating Lowrhc security update
- Red Hat CodeReady Linux Builder (v. 9) rhc-devel-1:0.2.5-1.el9_5
- Red Hat Enterprise Linux AppStream (v. 9) rhc-1:0.2.5-1.el9_5
- RHSA-2024:4631 Released 2024-07-18 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.15.0 release
- Red Hat OpenShift Dev Spaces 3 devspaces/configbump-rhel8, devspaces/dashboard-rhel8, devspaces/devspaces-rhel8-operator +4
Show 17 more Red Hat advisories
- RHSA-2024:4443 Released 2024-07-09 · Red Hat rating Importanttoolbox security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) toolbox-0.0.99.4-1.el9_2, toolbox-tests-0.0.99.4-1.el9_2
- RHSA-2024:0741 Released 2024-02-14 · Red Hat rating CriticalOpenShift Container Platform 4.13.33 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/egress-router-cni-rhel8, openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-cluster-authentication-operator +3
- RHSA-2023:6939 Released 2023-11-14 · Red Hat rating Moderatecontainer-tools:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.aarch64::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.ppc64le::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.s390x::container-tools:rhel8 +47
- RHSA-2023:6938 Released 2023-11-14 · Red Hat rating Moderatecontainer-tools:4.0 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.s390x::container-tools:4.0 +47
- RHSA-2023:6346 Released 2023-11-07 · Red Hat rating Moderatetoolbox security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.4-6.el9_3, toolbox-tests-0.0.99.4-6.el9_3
- RHSA-2023:5006 Released 2023-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.14.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
- RHSA-2023:3218 Released 2023-05-24 · Red Hat rating ModerateOpenShift Container Platform 4.10.60 security update
- Red Hat OpenShift Container Platform 4.10 openshift4/ose-sriov-cni
- RHSA-2023:2695 Released 2023-05-18 · Red Hat rating ModerateOpenShift Container Platform 4.11.40 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-sriov-cni
- RHSA-2023:2111 Released 2023-05-10 · Red Hat rating ModerateOpenShift Container Platform 4.12.16 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-sriov-cni
- RHSA-2023:1275 Released 2023-03-15 · Red Hat rating ImportantRed Hat OpenStack Platform (etcd) security update
- Red Hat OpenStack Platform 16.1 etcd-3.3.23-12.el8ost
- Red Hat OpenStack Platform 16.2 etcd-3.3.23-12.el8ost
- RHSA-2023:0899 Released 2023-03-01 · Red Hat rating ImportantOpenShift Container Platform 4.10.53 bug fix and security update
- Red Hat OpenShift Container Platform 4.10 openshift4/ose-csi-driver-manila-rhel8, openshift4/ose-installer, openshift4/ose-openstack-machine-controllers +1
- RHSA-2023:1014 Released 2023-02-28 · Red Hat rating ImportantRed Hat OpenStack Platform 17.0 (etcd) security update
- Red Hat OpenStack Platform 17.0 etcd-3.4.14-3.el9ost
- RHSA-2023:0778 Released 2023-02-22 · Red Hat rating ModerateOpenShift Container Platform 4.9.56 security update
- Red Hat OpenShift Container Platform 4.9 openshift4/ose-configmap-reloader
- RHSA-2023:0804 Released 2023-02-17 · Red Hat rating ImportantRed Hat OpenShift GitOps security update
- Red Hat OpenShift GitOps 1.5 openshift-gitops-1/applicationset-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/dex-rhel8 +2
- RHSA-2023:0803 Released 2023-02-17 · Red Hat rating ImportantRed Hat OpenShift GitOps security update
- Red Hat OpenShift GitOps 1.7 openshift-gitops-1/argocd-rhel8, openshift-gitops-1/dex-rhel8, openshift-gitops-1/gitops-rhel8-operator +1
- RHSA-2023:0802 Released 2023-02-17 · Red Hat rating ImportantRed Hat OpenShift GitOps security update
- Red Hat OpenShift GitOps 1.6 openshift-gitops-1/argocd-rhel8, openshift-gitops-1/dex-rhel8, openshift-gitops-1/gitops-rhel8-operator +1
- RHSA-2023:0698 Released 2023-02-15 · Red Hat rating ModerateOpenShift Container Platform 4.10.52 security update
- Red Hat OpenShift Container Platform 4.10 openshift4/ose-configmap-reloader
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 2 | Affected | No fix planned: Will not fix |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | — |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenStack Platform 16.1 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix yet |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2024:10759 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:6938, RHSA-2023:6939, RHSA-2024:10784 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:6346, RHSA-2024:10759 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:4443 |
| Red Hat OpenShift Container Platform 4.10 | Fixed | RHSA-2023:0698, RHSA-2023:0899, RHSA-2023:3218 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2023:2695 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2023:2111 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2024:0741 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2023:5006 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2023:0778 |
| Red Hat OpenShift Dev Spaces 3 | Fixed | RHSA-2024:4631 |
| Red Hat OpenShift GitOps 1.5 | Fixed | RHSA-2023:0804 |
| Red Hat OpenShift GitOps 1.6 | Fixed | RHSA-2023:0802 |
| Red Hat OpenShift GitOps 1.7 | Fixed | RHSA-2023:0803 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2023:1275 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2023:1275 |
| Red Hat OpenStack Platform 17.0 | Fixed | RHSA-2023:1014 |
Not affected: 56 products
- Custom Metric Autoscaler operator for Red Hat Openshift
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Applications 6
- Migration Toolkit for Containers
- Migration Toolkit for Virtualization
- Network Observability Operator
- Node HealthCheck Operator
- Node Maintenance Operator
- OpenShift API for Data Protection
- OpenShift Developer Tools and Services
- OpenShift Pipelines
- OpenShift Secondary Scheduler Operator
- OpenShift Serverless
- OpenShift Service Mesh 2
- OpenShift Service Mesh 2.1
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 1.2
- Red Hat Ansible Automation Platform 2
- Red Hat Application Interconnect 1.0
- Red Hat Ceph Storage 5
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.10
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.9
- Red Hat OpenShift Container Platform Assisted Installer 1
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces 3
- Red Hat OpenShift GitOps
- Red Hat OpenShift GitOps 1.5
- Red Hat OpenShift GitOps 1.6
- Red Hat OpenShift GitOps 1.7
- Red Hat OpenShift Virtualization 4
- Red Hat OpenShift distributed tracing 2
- Red Hat OpenShift on AWS
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Red Hat Openshift Container Storage 4
- Red Hat Openshift Data Foundation 4
- Red Hat Openshift Sandboxed Containers
- Red Hat Quay 3
- Red Hat Satellite 6
- Red Hat Software Collections
- Red Hat Storage 3
- Red Hat Web Terminal
- Self Node Remediation Operator
- Service Telemetry Framework 1.3 for RHEL 8
- Service Telemetry Framework 1.4 for RHEL 8
- cert-manager Operator for Red Hat OpenShift
- mirror registry for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3064
- 2026-10-03 Alias added: GHSA-6q6q-88xp-6f2r
References
Patch 2
Advisory 2
Other 14
- https://lists.debian.org/debian-lts-announce/2023/07/msg00001.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/
- https://github.com/go-yaml/yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI
More Yaml Project Yaml vulnerabilities
- TI-2023-02110 Uncaught Exception in eemeli/yaml CVSS 3.1HIGH 7.5
- TI-2021-03095 Denial of service in gopkg.in/yaml.v2 CVSS 3.1MEDIUM 5.5
- TI-2022-11545 An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when… CVSS 3.1HIGH 7.5
Sources
- CVE-2022-3064 · CVE Program
- CVE-2022-3064 · NVD
- FIRST EPSS
- GHSA-6q6q-88xp-6f2r · GitHub Advisory Database · CC BY 4.0
- CVE-2022-3064 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences