Go/gopkg.in/yaml.v3 CVE-2022-28948: high 7.5, EPSS 3.96%

gopkg.in/yaml.v3 Denial of Service

Action: Upgrade gopkg.in/yaml.v3 to 3.0.1 or later.

go get gopkg.in/yaml.v3@v3.0.1

Affected

Fixed versions

Sources

• osv: GHSA-hp87-p4gw-j4gq
• https://nvd.nist.gov/vuln/detail/CVE-2022-28948
• https://github.com/go-yaml/yaml/issues/665
• https://github.com/go-yaml/yaml/issues/666
• https://github.com/go-yaml/yaml/commit/8f96da9f5d5eff988554c1aae1784627c4bf6754
• https://github.com/go-yaml/yaml/commit/f6f7691b1fdeb513f56608cd2c32c51f8194bf51
• https://github.com/go-yaml/yaml
• https://security.netapp.com/advisory/ntap-20220923-0006

CVE-2022-28948 · published 2022-05-20T00:00:17Z · modified 2026-09-10T03:49:23.552237462Z · JSON