GO-2021-0061

vendorUSosv

Denial of service in gopkg.in/yaml.v2

view advisory published 2021-04-14Licence: per source

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-4235US	medium5.5	0.43% (37th)	—	2022-12-27
Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of…

references

External citations — patches, advisories, analysis.

https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241FIX
https://github.com/go-yaml/yaml/pull/375FIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan