Vulnerability · Published Dec 27, 2022 · Assigned by Go
CVE-2021-4235Denial of service in gopkg.in/yaml.v2
Medium 5.5
In plain English
A medium-severity security flaw in github.com/go-yaml/yaml from github.com/go-yaml/yaml. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.4%top 62.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-yaml.v2 | 2.2.8-1 | DEBIAN-CVE-2021-4235 |
| Debian:13 | golang-yaml.v2 | 2.2.8-1 | DEBIAN-CVE-2021-4235 |
| Debian:14 | golang-yaml.v2 | 2.2.8-1 | DEBIAN-CVE-2021-4235 |
| Go | github.com/go-yaml/yaml | no fix listed | GHSA-r88r-gmrh-7j83 |
| Go | github.com/go-yaml/yaml | no fix listed | GO-2021-0061 |
| Go | gopkg.in/yaml.v2 | 2.2.3 | GHSA-r88r-gmrh-7j83 |
| Go | gopkg.in/yaml.v2 | 2.2.3 | GO-2021-0061 |
| Ubuntu:22.04:LTS | golang-github-coreos-discovery-etcd-io | no fix listed | UBUNTU-CVE-2021-4235 |
| Ubuntu:24.04:LTS | golang-github-coreos-discovery-etcd-io | no fix listed | UBUNTU-CVE-2021-4235 |
| Ubuntu:25.10 | golang-github-coreos-discovery-etcd-io | no fix listed | UBUNTU-CVE-2021-4235 |
| Ubuntu:26.04:LTS | golang-github-coreos-discovery-etcd-io | no fix listed | UBUNTU-CVE-2021-4235 |
| Ubuntu:26.10 | golang-github-coreos-discovery-etcd-io | no fix listed | UBUNTU-CVE-2021-4235 |
| Ubuntu:25.10 | singularity-container | no fix listed | UBUNTU-CVE-2021-4235 |
| Ubuntu:26.04:LTS | singularity-container | no fix listed | UBUNTU-CVE-2021-4235 |
| Ubuntu:22.04:LTS | webhook | no fix listed | UBUNTU-CVE-2021-4235 |
| Ubuntu:24.04:LTS | webhook | no fix listed | UBUNTU-CVE-2021-4235 |
| Ubuntu:25.10 | webhook | no fix listed | UBUNTU-CVE-2021-4235 |
| Ubuntu:26.04:LTS | webhook | no fix listed | UBUNTU-CVE-2021-4235 |
| Ubuntu:26.10 | webhook | no fix listed | UBUNTU-CVE-2021-4235 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| gopkg.in/yaml.v2 | gopkg.in/yaml.v2 | 0 – before 2.2.3 |
| github.com/go-yaml/yaml | github.com/go-yaml/yaml | see references |