Denial of Service (DoS) Affecting github.com/go-yaml/yaml package, versions *
Threat Intelligence
EPSS
0.06% (24th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMGOYAMLYAML-6861567
- published 17 May 2024
- disclosed 14 Apr 2021
- credit Unknown
Introduced: 14 Apr 2021
CVE-2021-4235 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
github.com/go-yaml/yaml is a YAML support package for the Go language.
Affected versions of this package are vulnerable to Denial of Service (DoS) due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
References
CVSS Scores
version 3.1