Skip to content
OpenAdvisories
Medium · 5.5 CVE-2021-4235 EUVD-2022-7731GHSA-r88r-gmrh-7j83GO-2021-0061

Denial of service in gopkg.in/yaml.v2

Published Dec 27, 2022 · Updated Apr 11, 2025 · Assigned by Go

Vendor: github.com/go-yaml/yaml Vendor: gopkg.in/yaml.v2 Product: github.com/go-yaml/yaml Product: gopkg.in/yaml.v2 Package: buildah Package: delve Package: github.com/go-yaml/yaml Package: golang-github-coreos-discovery-etcd-io Package: golang-yaml.v2 Package: golang-yaml.v2 Package: gopkg.in/yaml.v2 Package: k3d Package: k3d-proxy Package: k3d-tools Package: podman Package: singularity-container Package: webhook Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.

Affected products

VendorProductAffectedFixed
gopkg.in/yaml.v2 gopkg.in/yaml.v2 < 2.2.3 2.2.3
github.com/go-yaml/yaml github.com/go-yaml/yaml — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-yaml.v2 2.2.8-1 —
Debian 13 golang-yaml.v2 2.2.8-1 —
Debian 12 golang-yaml.v2 2.2.8-1 —
Debian 10 golang-yaml.v2 2.2.2-1+deb10u1 DLA-3479-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 webhook +1 No fix yet —
Ubuntu 26.04 LTS webhook +2 No fix yet —
Ubuntu 25.10 webhook +2 No fix yet —
Ubuntu 24.04 LTS webhook +1 No fix yet —
Ubuntu 22.04 LTS webhook +1 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS golang-yaml.v2 2.2.2-1ubuntu0.1 USN-6287-1
Ubuntu 20.04 LTS webhook +1 No fix yet —
Ubuntu 18.04 LTS webhook No fix yet —
Ubuntu Pro 24.04 LTS singularity-container No fix yet —
Ubuntu Pro 18.04 LTS golang-yaml.v2 0.0+git20170407.0.cd8b52f-1ubuntu2+esm1 USN-6287-1
Ubuntu Pro 18.04 LTS singularity-container No fix yet —
Ubuntu Pro 16.04 LTS golang-yaml.v2 0.0+git20160301.0.a83829b-1ubuntu0.1~esm1 USN-6287-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Openshift Ironic 4 crudini 0.9.3-4.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 future 0.18.2-9.el9.1 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-ironic +4 1:21.0.1-0.20221114235951.fe64d5e.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-ironic-inspector +3 11.0.1-0.20221205155952.cd22607.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-ironic-python-agent 9.0.1-0.20220818145522.ad1eb41.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-macros 2020.1.2-1.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 pyOpenSSL +1 20.0.1-2.el9.1 RHSA-2022:7398
Red Hat Openshift Ironic 4 pyflakes 2.2.0-3.el9.1 RHSA-2022:7398
Red Hat Openshift Ironic 4 pysnmp 4.4.12-6.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 python-SecretStorage 2.3.1-9.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 python-alembic 1.6.0-1.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 python-amqp +1 5.0.6-1.el9 RHSA-2022:7398
Red Hat OpenShift 4 NetworkManager +14 1:1.36.0-8.el8_6 RHSA-2022:7398
Red Hat OpenShift 4 afterburn +1 5.3.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 afterburn-dracut 5.3.0-1.rhaos4.12.el9 RHSA-2022:7398
Red Hat OpenShift 4 ansible-runner +1 1.4.6-2.el8ar RHSA-2022:7398
Red Hat OpenShift 4 ansible-runner-http 1.0.0-2.el8ar RHSA-2022:7398
Red Hat OpenShift 4 atomic-openshift-service-idler 4.12.0-202210141624.p0.ga0f9090.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 bootupd +1 0.2.5-3.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 buildah +1 1:1.23.4-2.el8 RHSA-2022:7398
Red Hat OpenShift 4 butane +1 0.16.0-2.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 conmon 2:2.1.2-2.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 conmon-rs 0.4.0-2.rhaos4.12.git.el8 RHSA-2022:7398
Red Hat OpenShift 4 console-login-helper-messages +2 0.20.4-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 container-selinux 2:2.188.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 containernetworking-plugins 1.0.1-5.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 containers-common 2:1-27.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 coreos-installer +1 0.16.1-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 coreos-installer-dracut 0.16.1-1.rhaos4.12.el9 RHSA-2022:7398
Red Hat OpenShift 4 cri-o 1.25.1-5.rhaos4.12.git6005903.el8 RHSA-2022:7398
Red Hat OpenShift 4 cri-tools 1.25.0-2.el8 RHSA-2022:7398
Red Hat OpenShift 4 crit +4 3.15-4.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 crudini 0.9-11.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 crun 1.4.2-1.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 fuse-overlayfs 1.9-1.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 grpc +4 1.18.0-4.el8ost RHSA-2022:7398
Red Hat OpenShift 4 haproxy +1 2.2.24-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 ignition +1 2.14.0-5.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 kata-containers 2.5.2-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 kernel-rt +15 4.18.0-372.40.1.rt7.197.el8_6 RHSA-2022:7398
Red Hat OpenShift 4 libslirp +1 4.4.0-2.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 nmstate +4 1.3.3-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 openshift +1 4.12.0-202301042257.p0.g77bec7a.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 openshift-ansible +1 4.12.0-202211071957.p0.g3a9d20e.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 openshift-clients +1 4.12.0-202301042257.p0.g854f807.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 openshift-kuryr +4 4.12.0-202210261235.p0.g92b9be2.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 openvswitch2.17 +5 2.17.0-62.el8fdp RHSA-2022:7398
Red Hat OpenShift 4 ostree +3 2022.2-5.el8 RHSA-2022:7398
Red Hat OpenShift 4 ovn22.06 +3 22.06.0-27.el8fdp RHSA-2022:7398
Red Hat OpenShift 4 ovn22.09 +3 22.09.0-25.el8fdp RHSA-2022:7398
Red Hat OpenShift 4 podman +5 2:4.2.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 podman-gvproxy 3:4.2.0-4.rhaos4.12.el9 RHSA-2022:7398
Red Hat OpenShift 4 pycdlib-tools +2 1.11.0-3.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-alembic +1 1.4.2-5.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-amqp +2 2.5.2-7.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-cmd2 +1 1.4.0-1.1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-construct +1 2.10.56-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-dogpile-cache +1 1.1.2-1.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-eventlet +1 0.30.2-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-flask +2 1:1.1.1-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-funcsigs +2 1.0.2-8.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-gunicorn +1 19.9.0-10.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-ifaddr +1 0.1.6-5.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-importlib-metadata +1 1.7.0-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-iso8601 +1 0.1.12-8.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-jsonschema +1 3.2.0-5.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-kombu +1 1:4.6.6-7.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-kubernetes +2 25.3.0-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-lockfile +1 1:0.11.0-8.el8ar RHSA-2022:7398
Red Hat OpenShift 4 python-msgpack +1 0.6.2-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-config +1 2:8.7.1-0.20211012155707.1a7bd66.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-context +2 3.3.1-0.20211012152439.641a1e0.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-db +3 9.1.0-0.20211020204148.be2cc6a.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-i18n +2 5.1.0-0.20211012165753.b031d17.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-log +3 4.6.0-0.20211012154701.41c8807.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-messaging +2 12.9.1-0.20211020204149.f9de265.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-metrics +2 0.3.0-0.20211020174122.43eee50.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-policy +3 3.8.2-0.20211012161944.c7fd9f4.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-serialization +2 4.2.0-0.20211012151454.2b94a4f.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-packaging +2 20.4-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-paste +1 3.2.4-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-paste-deploy +1 2.0.1-4.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pexpect +1 4.6-2.el8ar RHSA-2022:7398
Red Hat OpenShift 4 python-pint +1 0.10.1-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyghmi +1 1.5.14-2.1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyperclip +2 1.6.4-6.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyroute2 +1 0.5.13-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyrsistent +1 0.16.0-3.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-requests-unixsocket +1 0.1.5-5.el8ar RHSA-2022:7398
Red Hat OpenShift 4 python-rsa +1 4.7-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-tenacity +1 6.2.0-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-wcwidth +1 0.1.7-14.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-werkzeug +1 1.0.1-3.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-zeroconf +1 0.24.4-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-zipp +1 0.5.1-2.el8ost RHSA-2022:7398
Red Hat OpenShift 4 rpm-ostree +2 2022.10.99.g0049dbdd-3.el8 RHSA-2022:7398
Red Hat OpenShift 4 runc 3:1.1.2-2.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 skopeo +1 2:1.8.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 slirp4netns 1.1.8-1.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 tini 0.16.1-1.el8ar RHSA-2022:7398
Red Hat OpenShift 4 toolbox 0.1.0-1.rhaos4.12.el8 RHSA-2022:7398

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 buildah 1.41.4-2 —
Azure Linux 3 delve No fix yet —
Azure Linux 3 podman 5.6.1-2 —
Azure Linux 2 (CBL-Mariner) delve +2 No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling k3d +2 5.6.0-r11 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/go-yaml/yaml <= 2.1.0 — GHSA-r88r-gmrh-7j83
Go github.com/go-yaml/yaml all versions — GO-2021-0061
Go gopkg.in/yaml.v2 < 2.2.3 2.2.3 GHSA-r88r-gmrh-7j83

Advisories 5

References