{"id":"CVE-2022-3064","title":"go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)","summary":"A flaw was found in go-yaml. This issue causes the consumption of excessive amounts of CPU or memory when attempting to parse a large or maliciously crafted YAML document.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-400","vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 8)","affected":["cryostat 2","openshift_serverless","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 3","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","openshift_container_platform 3.11","openshift_container_platform 4","openshift_gitops","openstack_platform 16.1","openstack_platform 16.2","quay 3","storage 3","enterprise_linux 10","openshift_gitops 1.5","openshift_gitops 1.6","openshift_gitops 1.7","openshift_dev_spaces 3","openshift_container_platform 4.10","openshift_container_platform 4.11","openshift_container_platform 4.12","openshift_container_platform 4.13","openshift_container_platform 4.14","openshift_container_platform 4.9","openstack_platform 17.0","enterprise_linux_appstream_v_8","enterprise_linux_appstream_eus_v_9_2","enterprise_linux_appstream_v_9","codeready_linux_builder_v_9"],"patched":["openshift_gitops 1.5","openshift_gitops 1.6","openshift_gitops 1.7","openstack_platform 16.1","openstack_platform 16.2","openshift_dev_spaces 3","openshift_container_platform 4.10","openshift_container_platform 4.11","openshift_container_platform 4.12","openshift_container_platform 4.13","openshift_container_platform 4.14","openshift_container_platform 4.9","openstack_platform 17.0","enterprise_linux_appstream_v_8","enterprise_linux_appstream_eus_v_9_2","enterprise_linux_appstream_v_9","codeready_linux_builder_v_9"],"published":"2022-08-29","updated":"2026-09-19","sourceUpdated":"2026-09-19T17:36:07+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-3064.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-3064.json"},{"url":"https://access.redhat.com/security/cve/CVE-2022-3064"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2163037"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3064"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3064"},{"url":"https://github.com/advisories/GHSA-6q6q-88xp-6f2r"},{"url":"https://github.com/go-yaml/yaml/commit/f221b8435cfb71e54062f6c6e99e9ade30b124d5"},{"url":"https://github.com/go-yaml/yaml/releases/tag/v2.2.4"},{"url":"https://pkg.go.dev/vuln/GO-2022-0956"},{"url":"https://access.redhat.com/errata/RHSA-2023:0804"},{"url":"https://access.redhat.com/errata/RHSA-2023:0802"},{"url":"https://access.redhat.com/errata/RHSA-2023:0803"},{"url":"https://access.redhat.com/errata/RHSA-2023:1275"},{"url":"https://access.redhat.com/errata/RHSA-2024:4631"},{"url":"https://access.redhat.com/errata/RHSA-2023:0698"},{"url":"https://access.redhat.com/errata/RHSA-2023:3218"},{"url":"https://access.redhat.com/errata/RHSA-2023:0899"},{"url":"https://access.redhat.com/errata/RHSA-2023:2695"},{"url":"https://access.redhat.com/errata/RHSA-2023:2111"},{"url":"https://access.redhat.com/errata/RHSA-2024:0741"},{"url":"https://access.redhat.com/errata/RHSA-2023:5006"},{"url":"https://access.redhat.com/errata/RHSA-2023:0778"},{"url":"https://access.redhat.com/errata/RHSA-2023:1014"},{"url":"https://access.redhat.com/errata/RHSA-2024:10784"},{"url":"https://access.redhat.com/errata/RHSA-2023:6938"},{"url":"https://access.redhat.com/errata/RHSA-2023:6939"},{"url":"https://access.redhat.com/errata/RHSA-2024:4443"},{"url":"https://access.redhat.com/errata/RHSA-2023:6346"},{"url":"https://access.redhat.com/errata/RHSA-2024:10759"},{"url":"https://github.com/go-yaml/yaml"},{"url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00001.html"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.017,"epssPercentile":0.75825,"aliases":["GHSA-6q6q-88xp-6f2r","GO-2022-0956"],"ecosystem":"go","ingestedAt":"2026-09-12T03:13:01.760Z","slug":"CVE-2022-3064","body":"## Overview\n\nA flaw was found in go-yaml. This issue causes the consumption of excessive amounts of CPU or memory when attempting to parse a large or maliciously crafted YAML document.\n\n## Vendor advisories\n\n- **RHSA-2023:0804** · Red Hat · fixed in: Red Hat OpenShift GitOps 1.5 · released 2023-02-17 · [advisory](https://access.redhat.com/errata/RHSA-2023:0804)\n- **RHSA-2023:0802** · Red Hat · fixed in: Red Hat OpenShift GitOps 1.6 · released 2023-02-17 · [advisory](https://access.redhat.com/errata/RHSA-2023:0802)\n- **RHSA-2023:0803** · Red Hat · fixed in: Red Hat OpenShift GitOps 1.7 · released 2023-02-17 · [advisory](https://access.redhat.com/errata/RHSA-2023:0803)\n- **RHSA-2023:1275** · Red Hat · fixed in: Red Hat OpenStack Platform 16.1, Red Hat OpenStack Platform 16.2 · released 2023-03-15 · [advisory](https://access.redhat.com/errata/RHSA-2023:1275)\n- **RHSA-2024:4631** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3 · released 2024-07-18 · [advisory](https://access.redhat.com/errata/RHSA-2024:4631)\n- **RHSA-2023:0698** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.10 · released 2023-02-15 · [advisory](https://access.redhat.com/errata/RHSA-2023:0698)\n- **RHSA-2023:3218** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.10 · released 2023-05-24 · [advisory](https://access.redhat.com/errata/RHSA-2023:3218)\n- **RHSA-2023:0899** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.10 · released 2023-03-01 · [advisory](https://access.redhat.com/errata/RHSA-2023:0899)\n- **RHSA-2023:2695** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.11 · released 2023-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2023:2695)\n- **RHSA-2023:2111** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2023-05-10 · [advisory](https://access.redhat.com/errata/RHSA-2023:2111)\n- **RHSA-2024:0741** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2024-02-14 · [advisory](https://access.redhat.com/errata/RHSA-2024:0741)\n- **Red Hat VEX** · Important · affected: Cryostat 2, OpenShift Serverless, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 3, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · no fix planned: Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 3.11, Cryostat 2, OpenShift Serverless, … · updated 2026-09-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-3064.json)\n\n**go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents** — rated Important by Red Hat. Released 2022-08-29, updated 2026-09-19.\n\nAffected:\n\n- Cryostat 2\n- OpenShift Serverless\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 3\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 3.11\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift GitOps\n- Red Hat OpenStack Platform 16.1\n- Red Hat OpenStack Platform 16.2\n- Red Hat Quay 3\n- Red Hat Storage 3\n- Red Hat Enterprise Linux 10\n\nFixed:\n\n- Red Hat OpenShift GitOps 1.5\n- Red Hat OpenShift GitOps 1.6\n- Red Hat OpenShift GitOps 1.7\n- Red Hat OpenStack Platform 16.1\n- Red Hat OpenStack Platform 16.2\n- Red Hat OpenShift Dev Spaces 3\n- Red Hat OpenShift Container Platform 4.10\n- Red Hat OpenShift Container Platform 4.11\n- Red Hat OpenShift Container Platform 4.12\n- Red Hat OpenShift Container Platform 4.13\n- Red Hat OpenShift Container Platform 4.14\n- Red Hat OpenShift Container Platform 4.9\n- Red Hat OpenStack Platform 17.0\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Enterprise Linux AppStream EUS (v.9.2)\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat CodeReady Linux Builder (v. 9)\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 7\n- Red Hat OpenShift Container Platform 3.11\n- Cryostat 2\n- OpenShift Serverless\n- Red Hat Enterprise Linux 8\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 3\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift GitOps\n- Red Hat OpenStack Platform 16.1\n- Red Hat OpenStack Platform 16.2\n- Red Hat Quay 3\n- Red Hat Storage 3\n\nNot affected:\n\n- Red Hat OpenShift GitOps 1.5\n- Red Hat OpenShift GitOps 1.6\n- Red Hat OpenShift GitOps 1.7\n- Red Hat OpenShift Dev Spaces 3\n- Red Hat OpenShift Container Platform 4.10\n- Red Hat OpenShift Container Platform 4.11\n- Red Hat OpenShift Container Platform 4.12\n- Red Hat OpenShift Container Platform 4.13\n- Red Hat OpenShift Container Platform 4.14\n- Red Hat OpenShift Container Platform 4.9\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2023:0804\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2023:0802\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2023:0803\n\n## Package advisory (CVE-2022-3064)\n\nAffected packages:\n\n- `gopkg.in/yaml.v2 < 2.2.4`\n\nPatched in:\n\n- `gopkg.in/yaml.v2 2.2.4`\n\nSource: https://osv.dev/vulnerability/GHSA-6q6q-88xp-6f2r","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}