CVE-2022-28948: gopkg.in/yaml.v3 Denial of Service – CVSS 7.5 · Watchpost

← All vulnerabilities

gopkg.in/yaml.v3 Denial of Service

高危 7.5CVE-2022-28948 · GHSA-hp87-p4gw-j4gq · GO-2022-0603 · Published 19/05/2022 · updated 17/06/2026

要点

CVE-2022-28948 是影响 gopkg.in/yaml.v3, yaml (yaml project) 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：4.0%，高于 90.5% 的漏洞。
修复：升级到 3.0.0-20220521103104-8f96da9f5d5e, 3.0.1 或更高版本。

Package	Affected versions	Patched versions
gopkg.in/yaml.v3 Go	`< 3.0.0-20220521103104-8f96da9f5d5e< 3.0.1`	`3.0.0-20220521103104-8f96da9f5d5e3.0.1`
yaml yaml_project	`= 3.0.0`	No fix yet

Description

An issue in the Unmarshal function in Go-Yaml v3 can cause a program to panic when attempting to deserialize invalid input.

NVD description

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.

References

nvd.nist.gov/vuln/detail/CVE-2022-28948 · ADVISORY
go-yaml/yaml · WEB
go-yaml/yaml · WEB
go-yaml/yaml commit 8f96da9 · WEB
go-yaml/yaml commit f6f7691 · WEB
go-yaml/yaml · PACKAGE
security.netapp.com/advisory/ntap-20220923-0006 · WEB
security.netapp.com/advisory/ntap-20220923-0006 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free