GO-2020-0036

Excessive resource consumption in YAML parsing in gopkg.in/yaml.v2

En bref

Publiée: 2021-04-14 20:04 UTC
Mise à jour: 2026-02-04 04:18 UTC
CVE: CVE-2019-11254
Alias: GHSA-wxc4-f4m6-wwqv

Description

Due to unbounded aliasing, a crafted YAML file can cause consumption of significant system resources. If parsing user supplied input, this may be used as a denial of service vector.

Paquets affectés

Paquet	Versions
Go · gopkg.in/yaml.v2	introduced 0, fixed 2.2.8
Go · github.com/go-yaml/yaml	introduced 0

Références

https://github.com/go-yaml/yaml/pull/555 FIX
https://github.com/go-yaml/yaml/commit/53403b58ad1b561927d19068c655246f2db79d48 FIX
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18496 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database