Fluid Attacks Database

Description

YAML Go package vulnerable to denial of service Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	golang-yaml.v2	>=0 <2.2.8-1	2.2.8-1
go	github.com/go-yaml/yaml	>=0 <=2.1.0	-
go	gopkg.in/yaml.v3	>=0 <2.2.3	v2.2.3
debian 11	golang-yaml.v2	>=0 <2.2.8-1	2.2.8-1
debian 13	golang-yaml.v2	>=0 <2.2.8-1	2.2.8-1
debian 14	golang-yaml.v2	>=0 <2.2.8-1	2.2.8-1
go	gopkg.in/yaml.v2	>=0 <2.2.3	2.2.3

Aliases

1. CVE-2021-42352. NVD-2021-42353. OSV-DEBIAN-2021-42354. OSV-2021-42355. GCVE-2021-42356. SECURITY-TRACKER-CVE-2021-42357. lists.debian.org

References

1. https://github.com/go-yaml/yaml/pull/3752. https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b2413. https://pkg.go.dev/vuln/GO-2021-0061

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.