CVE-2022-3064: yaml package for Go can consume excessive amounts of CPU or memory

December 28, 2022 (updated December 30, 2022)

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.

References

github.com/advisories/GHSA-6q6q-88xp-6f2r
github.com/go-yaml/yaml/commit/f221b8435cfb71e54062f6c6e99e9ade30b124d5
github.com/go-yaml/yaml/releases/tag/v2.2.4
nvd.nist.gov/vuln/detail/CVE-2022-3064
pkg.go.dev/vuln/GO-2022-0956

Detect and mitigate CVE-2022-3064 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →