GO-2020-0036
Excessive resource consumption in YAML parsing in gopkg.in/yaml.v2
At a glance
- Published
- Updated
- CVE
- CVE-2019-11254
- Aliases
- GHSA-wxc4-f4m6-wwqv
Description
Due to unbounded aliasing, a crafted YAML file can cause consumption of significant system resources. If parsing user supplied input, this may be used as a denial of service vector.
Affected packages
| Package | Versions |
|---|---|
| Go · gopkg.in/yaml.v2 | introduced 0, fixed 2.2.8 |
| Go · github.com/go-yaml/yaml | introduced 0 |
References
- https://github.com/go-yaml/yaml/pull/555 FIX
- https://github.com/go-yaml/yaml/commit/53403b58ad1b561927d19068c655246f2db79d48 FIX
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18496 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |