Read the docs
TI-2022-11545 Aliases CVE-2022-28948GHSA-hp87-p4gw-j4gq

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when…

Priority MEDIUM 40CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.

Why it matters now

EPSS 0.03965 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial gopkg.in/yaml.v3 (Go): 3.0.1Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—gopkg.in/yaml.v3 (Go)before 3.0.13.0.1Patch availableGHSA-hp87-p4gw-j4gq
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • gopkg.in/yaml.v3 (Go) Vendor— Affected before 3.0.1 Fixed in 3.0.1 Patch available GHSA-hp87-p4gw-j4gq

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:yaml_project:yaml:3.0.0:*:*:*:*:go:*:*3.0.0VulnerableYaml Project
cpe:2.3:a:netapp:astra_trident:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:yaml_project:yaml:3.0.0:*:*:*:*:go:*:* Versions 3.0.0 Vulnerable ·Yaml Project
  • cpe:2.3:a:netapp:astra_trident:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-hp87-p4gw-j4gq gopkg.in/yaml.v3 (Go) Fixed in 3.0.1 Advisory →

Red Hat 2 advisories

  • RHSA-2024:4631 Released 2024-07-18 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.15.0 release
    • Red Hat OpenShift Dev Spaces 3 devspaces/configbump-rhel8, devspaces/dashboard-rhel8, devspaces/devspaces-rhel8-operator +4
  • RHSA-2022:4985 Released 2022-06-09 · Red Hat rating Moderate
    Cryostat 2.1.1: new Cryostat on RHEL 8 container images
    • Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8, cryostat-tech-preview/cryostat-rhel8 +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
Cryostat 2 on RHEL 8Fixed RHSA-2022:4985
Red Hat OpenShift Dev Spaces 3Fixed RHSA-2024:4631
Not affected: 24 products
  • Cost Management Metrics Operator
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Migration Toolkit for Applications 6
  • Migration Toolkit for Containers
  • Migration Toolkit for Virtualization
  • Network Observability Operator
  • Node HealthCheck Operator
  • Node Maintenance Operator
  • OpenShift API for Data Protection
  • OpenShift Developer Tools and Services
  • Red Hat 3scale API Management Platform 2
  • Red Hat Ansible Automation Platform 1.2
  • Red Hat Ansible Automation Platform 2
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenShift Dev Spaces 3
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 2
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Data Foundation 4
  • cert-manager Operator for Red Hat OpenShift
  • mirror registry for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28948
  2. 2026-10-03 Alias added: GHSA-hp87-p4gw-j4gq

References

Exploit 1

Advisory 2

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences