The vulnerability of the Unmarshal function in the Go YAML library, related to deficiencies in the deserialization mechanism, allows attackers to trigger a denial-of-service attack.

🗓️ 05 Mar 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

The Go YAML library Unmarshal vulnerability in deserialization can be exploited remotely to cause denial of service.

Reporter	Title	Published	Views	Family All 72
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from go-yaml, OpenSSL, GnuTLS , OpenTelemetry-Go, go-toolset and urllib3	30 Jan 202408:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for AIOps	26 Mar 202504:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to multiple vulnerabilities	2 Oct 202410:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	12 Nov 202519:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2022	2 Sep 202219:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2 On Openshift, IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data	3 Aug 202216:26	–	ibm
IBM Security Bulletins	Security Bulletin: Mutiple vulnerabilties affecting Watson Machine Learning Accelerator on Cloud Pak for Data	12 Dec 202317:39	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container Operator and IntegrationServer operands are vulnerable to denial of service due to [CVE-2022-28948]	7 Sep 202315:16	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.	26 Mar 202504:00	–	ibm

Source	Link
github	www.github.com/go-yaml/yaml/issues/666
go	www.go.dev/play/p/gLM_eHzcrgz
github	www.github.com/advisories/GHSA-hp87-p4gw-j4gq
web	www.web.nvd.nist.gov/view/vuln/detail

05 Mar 2025 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 37.5

CVSS 27.8

EPSS0.035

go yaml unmarshal deserialization flaw remote exploitation denial of service