{"schema_version":"1.3.1","id":"GO-2022-0956","modified":"2024-05-20T16:03:47Z","published":"2022-08-29T22:15:46Z","aliases":["CVE-2022-3064","GHSA-6q6q-88xp-6f2r"],"summary":"Excessive resource consumption in gopkg.in/yaml.v2","details":"Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.","affected":[{"package":{"name":"gopkg.in/yaml.v2","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.4"}]}],"ecosystem_specific":{"imports":[{"path":"gopkg.in/yaml.v2","symbols":["Decoder.Decode","Unmarshal","UnmarshalStrict","decoder.unmarshal","yaml_parser_increase_flow_level","yaml_parser_roll_indent"]}]}}],"references":[{"type":"FIX","url":"https://github.com/go-yaml/yaml/commit/f221b8435cfb71e54062f6c6e99e9ade30b124d5"},{"type":"WEB","url":"https://github.com/go-yaml/yaml/releases/tag/v2.2.4"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2022-0956","review_status":"REVIEWED"}}