--- id: CVE-2022-3064 title: >- go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064) summary: >- A flaw was found in go-yaml. This issue causes the consumption of excessive amounts of CPU or memory when attempting to parse a large or maliciously crafted YAML document. severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: CWE-400 vendor: Red Hat product: Red Hat Enterprise Linux AppStream (v. 8) affected: - cryostat 2 - openshift_serverless - advanced_cluster_management_for_kubernetes 2 - advanced_cluster_security 3 - enterprise_linux 7 - enterprise_linux 8 - enterprise_linux 9 - openshift_container_platform 3.11 - openshift_container_platform 4 - openshift_gitops - openstack_platform 16.1 - openstack_platform 16.2 - quay 3 - storage 3 - enterprise_linux 10 - openshift_gitops 1.5 - openshift_gitops 1.6 - openshift_gitops 1.7 - openshift_dev_spaces 3 - openshift_container_platform 4.10 - openshift_container_platform 4.11 - openshift_container_platform 4.12 - openshift_container_platform 4.13 - openshift_container_platform 4.14 - openshift_container_platform 4.9 - openstack_platform 17.0 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_eus_v_9_2 - enterprise_linux_appstream_v_9 - codeready_linux_builder_v_9 patched: - openshift_gitops 1.5 - openshift_gitops 1.6 - openshift_gitops 1.7 - openstack_platform 16.1 - openstack_platform 16.2 - openshift_dev_spaces 3 - openshift_container_platform 4.10 - openshift_container_platform 4.11 - openshift_container_platform 4.12 - openshift_container_platform 4.13 - openshift_container_platform 4.14 - openshift_container_platform 4.9 - openstack_platform 17.0 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_eus_v_9_2 - enterprise_linux_appstream_v_9 - codeready_linux_builder_v_9 published: '2022-08-29' updated: '2026-09-19' sourceUpdated: '2026-09-19T17:36:07+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-3064.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-3064.json - url: 'https://access.redhat.com/security/cve/CVE-2022-3064' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2163037' - url: 'https://www.cve.org/CVERecord?id=CVE-2022-3064' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-3064' - url: 'https://github.com/advisories/GHSA-6q6q-88xp-6f2r' - url: >- https://github.com/go-yaml/yaml/commit/f221b8435cfb71e54062f6c6e99e9ade30b124d5 - url: 'https://github.com/go-yaml/yaml/releases/tag/v2.2.4' - url: 'https://pkg.go.dev/vuln/GO-2022-0956' - url: 'https://access.redhat.com/errata/RHSA-2023:0804' - url: 'https://access.redhat.com/errata/RHSA-2023:0802' - url: 'https://access.redhat.com/errata/RHSA-2023:0803' - url: 'https://access.redhat.com/errata/RHSA-2023:1275' - url: 'https://access.redhat.com/errata/RHSA-2024:4631' - url: 'https://access.redhat.com/errata/RHSA-2023:0698' - url: 'https://access.redhat.com/errata/RHSA-2023:3218' - url: 'https://access.redhat.com/errata/RHSA-2023:0899' - url: 'https://access.redhat.com/errata/RHSA-2023:2695' - url: 'https://access.redhat.com/errata/RHSA-2023:2111' - url: 'https://access.redhat.com/errata/RHSA-2024:0741' - url: 'https://access.redhat.com/errata/RHSA-2023:5006' - url: 'https://access.redhat.com/errata/RHSA-2023:0778' - url: 'https://access.redhat.com/errata/RHSA-2023:1014' - url: 'https://access.redhat.com/errata/RHSA-2024:10784' - url: 'https://access.redhat.com/errata/RHSA-2023:6938' - url: 'https://access.redhat.com/errata/RHSA-2023:6939' - url: 'https://access.redhat.com/errata/RHSA-2024:4443' - url: 'https://access.redhat.com/errata/RHSA-2023:6346' - url: 'https://access.redhat.com/errata/RHSA-2024:10759' - url: 'https://github.com/go-yaml/yaml' - url: 'https://lists.debian.org/debian-lts-announce/2023/07/msg00001.html' - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI tags: - csaf - vex - red-hat - osv - go epss: 0.017 epssPercentile: 0.76221 aliases: - GHSA-6q6q-88xp-6f2r - GO-2022-0956 ecosystem: go ingestedAt: '2026-09-12T03:13:01.760Z' --- ## Overview A flaw was found in go-yaml. This issue causes the consumption of excessive amounts of CPU or memory when attempting to parse a large or maliciously crafted YAML document. ## Vendor advisories - **RHSA-2023:0804** · Red Hat · fixed in: Red Hat OpenShift GitOps 1.5 · released 2023-02-17 · [advisory](https://access.redhat.com/errata/RHSA-2023:0804) - **RHSA-2023:0802** · Red Hat · fixed in: Red Hat OpenShift GitOps 1.6 · released 2023-02-17 · [advisory](https://access.redhat.com/errata/RHSA-2023:0802) - **RHSA-2023:0803** · Red Hat · fixed in: Red Hat OpenShift GitOps 1.7 · released 2023-02-17 · [advisory](https://access.redhat.com/errata/RHSA-2023:0803) - **RHSA-2023:1275** · Red Hat · fixed in: Red Hat OpenStack Platform 16.1, Red Hat OpenStack Platform 16.2 · released 2023-03-15 · [advisory](https://access.redhat.com/errata/RHSA-2023:1275) - **RHSA-2024:4631** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3 · released 2024-07-18 · [advisory](https://access.redhat.com/errata/RHSA-2024:4631) - **RHSA-2023:0698** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.10 · released 2023-02-15 · [advisory](https://access.redhat.com/errata/RHSA-2023:0698) - **RHSA-2023:3218** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.10 · released 2023-05-24 · [advisory](https://access.redhat.com/errata/RHSA-2023:3218) - **RHSA-2023:0899** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.10 · released 2023-03-01 · [advisory](https://access.redhat.com/errata/RHSA-2023:0899) - **RHSA-2023:2695** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.11 · released 2023-05-18 · [advisory](https://access.redhat.com/errata/RHSA-2023:2695) - **RHSA-2023:2111** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2023-05-10 · [advisory](https://access.redhat.com/errata/RHSA-2023:2111) - **RHSA-2024:0741** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2024-02-14 · [advisory](https://access.redhat.com/errata/RHSA-2024:0741) - **Red Hat VEX** · Important · affected: Cryostat 2, OpenShift Serverless, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 3, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · no fix planned: Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 3.11, Cryostat 2, OpenShift Serverless, … · updated 2026-09-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-3064.json) **go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents** — rated Important by Red Hat. Released 2022-08-29, updated 2026-09-19. Affected: - Cryostat 2 - OpenShift Serverless - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 3 - Red Hat Enterprise Linux 7 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat OpenShift Container Platform 3.11 - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift GitOps - Red Hat OpenStack Platform 16.1 - Red Hat OpenStack Platform 16.2 - Red Hat Quay 3 - Red Hat Storage 3 - Red Hat Enterprise Linux 10 Fixed: - Red Hat OpenShift GitOps 1.5 - Red Hat OpenShift GitOps 1.6 - Red Hat OpenShift GitOps 1.7 - Red Hat OpenStack Platform 16.1 - Red Hat OpenStack Platform 16.2 - Red Hat OpenShift Dev Spaces 3 - Red Hat OpenShift Container Platform 4.10 - Red Hat OpenShift Container Platform 4.11 - Red Hat OpenShift Container Platform 4.12 - Red Hat OpenShift Container Platform 4.13 - Red Hat OpenShift Container Platform 4.14 - Red Hat OpenShift Container Platform 4.9 - Red Hat OpenStack Platform 17.0 - Red Hat Enterprise Linux AppStream (v. 8) - Red Hat Enterprise Linux AppStream EUS (v.9.2) - Red Hat Enterprise Linux AppStream (v. 9) - Red Hat CodeReady Linux Builder (v. 9) No fix planned: - Red Hat Enterprise Linux 7 - Red Hat OpenShift Container Platform 3.11 - Cryostat 2 - OpenShift Serverless - Red Hat Enterprise Linux 8 - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 3 - Red Hat Enterprise Linux 9 - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift GitOps - Red Hat OpenStack Platform 16.1 - Red Hat OpenStack Platform 16.2 - Red Hat Quay 3 - Red Hat Storage 3 Not affected: - Red Hat OpenShift GitOps 1.5 - Red Hat OpenShift GitOps 1.6 - Red Hat OpenShift GitOps 1.7 - Red Hat OpenShift Dev Spaces 3 - Red Hat OpenShift Container Platform 4.10 - Red Hat OpenShift Container Platform 4.11 - Red Hat OpenShift Container Platform 4.12 - Red Hat OpenShift Container Platform 4.13 - Red Hat OpenShift Container Platform 4.14 - Red Hat OpenShift Container Platform 4.9 ## Remediation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2023:0804 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2023:0802 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2023:0803 ## Package advisory (CVE-2022-3064) Affected packages: - `gopkg.in/yaml.v2 < 2.2.4` Patched in: - `gopkg.in/yaml.v2 2.2.4` Source: https://osv.dev/vulnerability/GHSA-6q6q-88xp-6f2r