USN-6287-1 golang-yaml.v2 vulnerabilities

🗓️ 14 Aug 2023 08:42:37Reported by GoogleType

osv

osv🔗 osv.dev

Go yaml package vulnerabilities allow denial of service via crafted or large YAML inputs.

Reporter	Title	Published	Views	Family All 215
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion and IBM Storage Fusion HCI may be vulnerable to denial of service and link following via Go-Yaml, kube-apiserver, Golang Go and Beego	29 Aug 202321:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Connector for SAP is affected by security vulnerabilities	2 Apr 202418:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	26 Mar 202503:48	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in the Golang language affects IBM Event Streams (CVE-2022-3064)	6 Mar 202307:49	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0050: container-tools:rhel8 (ALINUX3-SA-2024:0050)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : container-tools:4.0 (ALSA-2023:6938)	2 Jul 202500:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: etcd / packer (CVE-2022-3064)	10 Feb 202500:00	–	nessus
Tenable Nessus	Debian dla-3479 : golang-gopkg-yaml.v2-dev - security update	6 Jul 202300:00	–	nessus
Tenable Nessus	Fedora 37 : manifest-tool (2023-11dafed208)	14 Mar 202300:00	–	nessus
Tenable Nessus	Fedora 38 : manifest-tool (2023-5312f6200c)	10 Mar 202300:00	–	nessus

Source	Link
ubuntu	www.ubuntu.com/security/notices/USN-6287-1
ubuntu	www.ubuntu.com/security/CVE-2021-4235
ubuntu	www.ubuntu.com/security/CVE-2022-3064

20 May 2026 16:03Current

7.2High risk

Vulners AI Score7.2

CVSS 3.17.5

EPSS0.02514

SSVC

yaml vulnerability denial of service crafted inputs large documents remote attacker go library yaml package