{"action":"Upgrade gopkg.in/yaml.v2 to 2.2.8 or later.","affected":[{"fixed":"2.2.8","introduced":"0"}],"component":"gopkg.in/yaml.v2","cve_ids":["CVE-2019-11254"],"ecosystem":"Go","epss":0.03157,"exploited":false,"fixed_versions":["2.2.8"],"ghsa_id":"GHSA-wxc4-f4m6-wwqv","id":"tcs_01M5KFT689E1AZDJ6XNX8S5EFW","modified_at":"2026-02-04T04:18:29.126333Z","published_at":"2021-04-14T20:04:52Z","references":["https://osv.dev/vulnerability/GO-2020-0036","https://github.com/go-yaml/yaml/pull/555","https://github.com/go-yaml/yaml/commit/53403b58ad1b561927d19068c655246f2db79d48","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18496"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GO-2020-0036","url":"https://osv.dev/vulnerability/GO-2020-0036"},{"source":"nvd","source_id":"CVE-2019-11254","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11254"}],"summary":"Excessive resource consumption in YAML parsing in gopkg.in/yaml.v2"}