title: Denial of service in gopkg.in/yaml.v2
description: Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
problem types: CWE 400: Uncontrolled Resource Consumption
affected:
{
vendor: gopkg.in/yaml.v2
product: gopkg.in/yaml.v2
collectionURL: https://pkg.go.dev
packageName: gopkg.in/yaml.v2
versions:
version: 0, lessThan: 2.2.3, status: affected, versionType: semver
programRoutines:
name: decoder.unmarshal
name: Decoder.Decode
name: Unmarshal
name: UnmarshalStrict
defaultStatus: unaffected
}
{
vendor: github.com/go-yaml/yaml
product: github.com/go-yaml/yaml
collectionURL: https://pkg.go.dev
packageName: github.com/go-yaml/yaml
programRoutines:
name: decoder.unmarshal
name: Decoder.Decode
name: Unmarshal
name: UnmarshalStrict
defaultStatus: affected
}
