{"id":"CVE-2022-28948","aliases":["ALPINE-CVE-2022-28948","AZL-31966","DEBIAN-CVE-2022-28948","EUVD-2022-4183","GHSA-hp87-p4gw-j4gq","GO-2022-0603","SUSE-SU-2025:02998-1","SUSE-SU-2025:02999-1","SUSE-SU-2025:03000-1","SUSE-SU-2025:03001-1","SUSE-SU-2026:22997-1","UBUNTU-CVE-2022-28948","openSUSE-SU-2024:0319-1","openSUSE-SU-2024:12490-1","openSUSE-SU-2025:15510-1","openSUSE-SU-2025:15529-1","openSUSE-SU-2026:12166-1","openSUSE-SU-2026:21457-1"],"status":"published","title":"gopkg.in/yaml.v3 Denial of Service","description":"An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03965,"percentile":0.90542,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2022-05-19T19:59:30Z","modified":"2026-11-03T08:02:17Z","fixes":[{"ecosystem":"Go","package":"gopkg.in/yaml.v3","fixed_in":["3.0.1","3.0.0-20220521103104-8f96da9f5d5e"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"coredns","fixed_in":["1.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"coredns","fixed_in":["1.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"coredns","fixed_in":["1.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"coredns","fixed_in":["1.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"coredns","fixed_in":["1.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"coredns","fixed_in":["1.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"coredns","fixed_in":["1.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"coredns","fixed_in":["1.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"coredns","fixed_in":["1.9.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"kured","fixed_in":["1.13.2-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"golang-gopkg-yaml.v3","fixed_in":["3.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-gopkg-yaml.v3","fixed_in":["3.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-gopkg-yaml.v3","fixed_in":["3.0.1-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ignition","fixed_in":["2.14.0-150300.4.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"ignition","fixed_in":["2.14.0-150400.4.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"ignition","fixed_in":["2.14.0-150300.6.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP6","package":"ignition","fixed_in":["2.14.0-150400.9.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","package":"ignition","fixed_in":["2.14.0-150400.9.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"ignition","fixed_in":["2.14.0-150400.9.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"hawk-apiserver","fixed_in":["0.1.0+git.1781014483.1c464f2-160000.1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"snapd","fixed_in":["2.63+20.04ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"snapd","fixed_in":["2.63+22.04ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"snapd","fixed_in":["2.62+24.04build1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"traefik2","fixed_in":["2.11.29-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"hawk-apiserver","fixed_in":["0.1.0+git.1781014483.1c464f2-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"gopkg.in/yaml.v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kured","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-gopkg-yaml.v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-gopkg-yaml.v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-gopkg-yaml.v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1"}]}]},{"source":"osv","ecosystem":"Go","package":"gopkg.in/yaml.v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"Go","package":"gopkg.in/yaml.v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.0-20220521103104-8f96da9f5d5e"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.0-150300.4.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.0-150400.4.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.0-150300.6.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP6","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.0-150400.9.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.0-150400.9.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ignition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.0-150400.9.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 16.0","package":"hawk-apiserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0+git.1781014483.1c464f2-160000.1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9","1.9.1.1","1.9.2","2.0","2.0.1","2.0.2","2.0.3","2.0.5","2.0.8","2.0.9","2.0.10","2.11+0.16.04","2.12+0.16.04","2.13","2.14.2~16.04","2.15.2ubuntu1","2.16ubuntu3","2.17.1ubuntu1","2.20.1ubuntu1","2.21","2.22.2","2.22.3","2.22.6","2.23.1","2.24.1","2.25","2.26.10","2.27.5","2.28.5","2.29.4.2","2.32.3.2","2.32.9","2.33.1ubuntu2","2.34.2","2.34.2ubuntu0.1","2.37.4","2.37.4ubuntu0.1","2.38","2.39.2","2.39.2ubuntu0.2","2.40","2.42.1","2.45.1","2.45.1ubuntu0.2","2.46.1","2.47.1","2.48","2.48.3","2.54.3+16.04~esm2","2.54.3+16.04.0ubuntu0.1~esm3","2.54.3+16.04.0ubuntu0.1~esm4","2.54.3+16.04.0ubuntu0.1~esm5","2.54.3+16.04.0ubuntu0.1~esm6","2.61.4ubuntu0.16.04.1+esm1","2.61.4ubuntu0.16.04.1+esm2","2.61.4ubuntu0.16.04.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.28.5+17.10","2.29.4.1+18.04","2.29.4.2+18.04","2.31.1+18.04","2.32+18.04~pre5","2.32+18.04~pre6","2.32+18.04","2.32.3.2+18.04","2.32.5+18.04","2.32.8+18.04","2.32.9+18.04","2.33.1+18.04ubuntu2","2.34.2+18.04","2.34.2+18.04.1","2.37.1+18.04","2.37.1.1+18.04","2.37.4+18.04","2.37.4+18.04.1","2.38+18.04","2.39.2+18.04","2.40+18.04","2.42.1+18.04","2.45.1+18.04","2.45.1+18.04.2","2.46.1+18.04","2.47.1+18.04","2.48+18.04","2.48.3+18.04","2.49.2+18.04","2.51.1+18.04","2.54.2+18.04ubuntu1","2.54.3+18.04","2.54.3+18.04.2ubuntu0.1","2.54.3+18.04.2ubuntu0.2","2.55.5+18.04","2.57.5+18.04","2.57.5+18.04ubuntu0.1","2.58+18.04","2.58+18.04.1","2.61.4ubuntu0.18.04.1+esm1","2.61.4ubuntu0.18.04.1+esm2","2.61.4ubuntu0.18.04.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.63+20.04ubuntu0.1"}]}],"versions":["2.41+19.10.1","2.42.1+20.04","2.43.3+git1.8109f8","2.44~pre1+20.04","2.44+20.04","2.44.2+20.04","2.44.3+20.04","2.45.1+20.04","2.45.1+20.04.2","2.46.1+20.04","2.47.1+20.04","2.48+20.04","2.48.3+20.04","2.49.2+20.04","2.51.1+20.04ubuntu2","2.54.2+20.04ubuntu2","2.54.3+20.04","2.54.3+20.04.1","2.54.3+20.04.1ubuntu0.1","2.54.3+20.04.1ubuntu0.2","2.54.3+20.04.1ubuntu0.3","2.55.5+20.04","2.57.5+20.04","2.57.5+20.04ubuntu0.1","2.58+20.04","2.58+20.04.1","2.61.3+20.04","2.62+20.04","2.63+20.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-gopkg-yaml.v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.0~git20200121.a6ecf24-3","3.0.0~git20210107.496545a-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.63+22.04ubuntu0.1"}]}],"versions":["2.53+21.10ubuntu1","2.54.2+22.04ubuntu1","2.54.2+22.04ubuntu2","2.54.2+22.04ubuntu3","2.54.3+git19.g868fc21+22.04","2.54.3+git26.g360067e+22.04","2.55.2+22.04","2.55.2+22.04.1","2.55.3+22.04","2.55.3+22.04ubuntu1","2.55.5+22.04","2.56.2+22.04ubuntu1","2.57.4+22.04","2.57.5+22.04","2.57.5+22.04ubuntu0.1","2.58+22.04","2.58+22.04.1","2.61.3+22.04","2.62+22.04","2.63+22.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"snapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62+24.04build1"}]}],"versions":["2.60.4+23.10","2.61.3+24.04"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.3-bp156.4.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.3-bp156.4.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.29-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"percona-toolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1.4-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hawk-apiserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0+git.1781014483.1c464f2-160000.1.1"}]}]}],"products":[{"vendor":"netapp","product":"astra_trident"},{"vendor":"yaml_project","product":"yaml"}],"references":[{"url":"https://github.com/go-yaml/yaml/issues/666","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220923-0006/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28948","tags":["web","advisory"]},{"url":"https://github.com/go-yaml/yaml/commit/8f96da9f5d5eff988554c1aae1784627c4bf6754","tags":["web","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20220923-0006","tags":["web"]},{"url":"https://github.com/go-yaml/yaml/issues/665","tags":["web"]},{"url":"https://github.com/go-yaml/yaml/commit/f6f7691b1fdeb513f56608cd2c32c51f8194bf51","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hp87-p4gw-j4gq","tags":["report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-28948","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28948.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-28948","tags":["advisory"]},{"url":"https://github.com/go-yaml/yaml","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502998-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248548","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28948","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502999-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503000-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503001-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622997-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237259","tags":["report"]},{"url":"https://bugzilla.suse.com/1248563","tags":["report"]},{"url":"https://bugzilla.suse.com/1267454","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-28948","tags":["report"]},{"url":"https://github.com/go-yaml/yaml/issues/666#issuecomment-1133337993","tags":["report"]},{"url":"https://security.snyk.io/vuln/SNYK-GOLANG-GOPKGINYAMLV2-2840885","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28948","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2JLUFKCHWHJJ2MQ6XRREF7D4OOWB23V2/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-30464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22189","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-28948","description":"An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.","status":"published","published":"2022-05-19T19:59:30Z","modified":"2024-08-03T06:10:57.622Z","updated_at":"2026-11-02T14:34:38.922686Z"}],"euvd":[{"id":"EUVD-2022-4183","description":"An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.","status":"published","published":"2022-05-19T19:59:30Z","modified":"2024-08-03T06:10:57Z","updated_at":"2026-11-03T03:25:39.28463Z"}],"ghsa":[{"id":"GHSA-hp87-p4gw-j4gq","title":"gopkg.in/yaml.v3 Denial of Service","description":"An issue in the Unmarshal function in Go-Yaml v3 can cause a program to panic when attempting to deserialize invalid input.","status":"published","published":"2022-05-20T00:00:17Z","modified":"2025-08-27T22:58:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:38:55.953734Z"}],"nvd":[{"id":"CVE-2022-28948","description":"An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.","status":"published","published":"2022-05-19T20:15:10.567Z","modified":"2026-06-17T04:39:21.763Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:20.264424Z"}],"osv":[{"id":"ALPINE-CVE-2022-28948","description":"An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.","status":"published","published":"2022-05-19T20:15:10.567Z","modified":"2026-11-03T07:30:36.715403064Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-31966","title":"CVE-2022-28948 affecting package kured for versions less than 1.13.2-1","description":"An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.","status":"published","published":"2022-05-19T20:15:10Z","modified":"2026-04-21T04:26:36.091021Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"DEBIAN-CVE-2022-28948","description":"An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.","status":"published","published":"2022-05-19T20:15:10.567Z","modified":"2026-11-03T08:02:17.512779272Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"GHSA-hp87-p4gw-j4gq","title":"gopkg.in/yaml.v3 Denial of Service","description":"An issue in the Unmarshal function in Go-Yaml v3 can cause a program to panic when attempting to deserialize invalid input.","status":"published","published":"2022-05-20T00:00:17Z","modified":"2026-09-10T03:49:23.552237462Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"UBUNTU-CVE-2022-28948","description":"An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.","status":"published","published":"2022-05-19T20:15:00Z","modified":"2026-07-21T18:21:19.998796075Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"CVE-2022-28948","description":"An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.","status":"published","published":"2022-05-19T19:59:30Z","modified":"2026-10-28T02:30:38.939154591Z","updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"GO-2022-0603","title":"Panic in gopkg.in/yaml.v3","description":"An issue in the Unmarshal function can cause a program to panic when attempting to deserialize invalid input.","status":"published","published":"2022-08-22T18:00:47Z","modified":"2026-02-04T03:15:39.976408Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"openSUSE-SU-2024:0319-1","title":"Security update for coredns","description":"This update for coredns fixes the following issues:\n\nUpdate to version 1.11.3:\n\n  * optimize the performance for high qps (#6767)\n  * bump deps\n  * Fix zone parser error handling (#6680)\n  * Add alternate option to forward plugin (#6681)\n  * fix: plugin/file: return error when parsing the file fails (#6699)\n  * [fix:documentation] Clarify autopath README (#6750)\n  * Fix outdated test (#6747)\n  * Bump go version from 1.21.8 to 1.21.11 (#6755)\n  * Generate zplugin.go correctly with third-party plugins (#6692)\n  * dnstap: uses pointer receiver for small response writer (#6644)\n  * chore: fix function name in comment (#6608)\n  * [plugin/forward] Strip local zone from IPV6 nameservers (#6635)\n- fixes CVE-2023-30464\n- fixes CVE-2023-28452\n\nUpdate to upstream head (git commit #5a52707):\n\n  * bump deps to address security issue CVE-2024-22189\n  * Return RcodeServerFailure when DNS64 has no next plugin (#6590)\n  * add plusserver to adopters (#6565)\n  * Change the log flags to be a variable that can be set prior to calling Run (#6546)\n  * Enable Prometheus native histograms (#6524)\n  * forward: respect context (#6483)\n  * add client labels to k8s plugin metadata (#6475)\n  * fix broken link in webpage (#6488)\n  * Repo controlled Go version (#6526)\n  * removed the mutex locks with atomic bool (#6525)\n\nUpdate to version 1.11.2:\n\n  * rewrite: fix multi request concurrency issue in cname rewrite  (#6407)\n  * plugin/tls: respect the path specified by root plugin (#6138)\n  * plugin/auto: warn when auto is unable to read elements of the directory tree (#6333)\n  * fix: make the codeowners link relative (#6397)\n  * plugin/etcd: the etcd client adds the DialKeepAliveTime parameter (#6351)\n  * plugin/cache: key cache on Checking Disabled (CD) bit (#6354)\n  * Use the correct root domain name in the proxy plugin's TestHealthX tests (#6395)\n  * Add PITS Global Data Recovery Services as an adopter (#6304)\n  * Handle UDP responses that overflow with TC bit with test case (#6277)\n  * plugin/rewrite: add rcode as a rewrite option (#6204)\n\n- CVE-2024-0874: coredns: CD bit response is cached and served later\n\n- Update to version 1.11.1:\n\n  * Revert “plugin/forward: Continue waiting after receiving malformed responses\n  * plugin/dnstap: add support for “extra” field in payload\n  * plugin/cache: fix keepttl parsing\n\n- Update to version 1.11.0:\n\n  * Adds support for accepting DNS connections over QUIC (doq).\n  * Adds CNAME target rewrites to the rewrite plugin.\n  * Plus many bug fixes, and some security improvements.\n  * This release introduces the following backward incompatible changes:\n   + In the kubernetes plugin, we have dropped support for watching Endpoint and Endpointslice v1beta, \n     since all supported K8s versions now use Endpointslice.\n   + The bufsize plugin changed its default size limit value to 1232\n   + Some changes to forward plugin metrics.\n\n- Update to version 1.10.1:\n\n  * Corrected architecture labels in multi-arch image manifest\n  * A new plugin timeouts that allows configuration of server listener timeout durations\n  * acl can drop queries as an action\n  * template supports creating responses with extended DNS errors\n  * New weighted policy in loadbalance\n  * Option to serve original record TTLs from cache\n\n- Update to version 1.10.0:\n\n\t* core: add log listeners for k8s_event plugin (#5451)\n\t* core: log DoH HTTP server error logs in CoreDNS format (#5457)\n\t* core: warn when domain names are not in RFC1035 preferred syntax (#5414)\n\t* plugin/acl: add support for extended DNS errors (#5532)\n\t* plugin/bufsize: do not expand query UDP buffer size if already set to a smaller value (#5602)\n\t* plugin/cache: add cache disable option (#5540)\n\t* plugin/cache: add metadata for wildcard record responses (#5308)\n\t* plugin/cache: add option to adjust SERVFAIL response cache TTL (#5320)\n\t* plugin/cache: correct responses to Authenticated Data requests (#5191)\n\t* plugin/dnstap: add identity and version support for the dnstap plugin (#5555)\n\t* plugin/file: add metadata for wildcard record responses (#5308)\n\t* plugin/forward: enable multiple forward declarations (#5127)\n\t* plugin/forward: health_check needs to normalize a specified domain name (#5543)\n\t* plugin/forward: remove unused coredns_forward_sockets_open metric (#5431)\n\t* plugin/header: add support for query modification (#5556)\n\t* plugin/health: bypass proxy in self health check (#5401)\n\t* plugin/health: don't go lameduck when reloading (#5472)\n\t* plugin/k8s_external: add support for PTR requests (#5435)\n\t* plugin/k8s_external: resolve headless services (#5505)\n\t* plugin/kubernetes: make kubernetes client log in CoreDNS format (#5461)\n\t* plugin/ready: reset list of readiness plugins on startup (#5492)\n\t* plugin/rewrite: add PTR records to supported types (#5565)\n\t* plugin/rewrite: fix a crash in rewrite plugin when rule type is missing (#5459)\n\t* plugin/rewrite: fix out-of-index issue in rewrite plugin (#5462)\n\t* plugin/rewrite: support min and max TTL values (#5508)\n\t* plugin/trace : make zipkin HTTP reporter more configurable using Corefile (#5460)\n\t* plugin/trace: read trace context info from headers for DOH (#5439)\n\t* plugin/tsig: add new plugin TSIG for validating TSIG requests and signing responses (#4957)\n\t* core: update gopkg.in/yaml.v3 to fix CVE-2022-28948 \n\t* core: update golang.org/x/crypto to fix CVE-2022-27191 \n\t* plugin/acl: adding a check to parse out zone info \n\t* plugin/dnstap: support FQDN TCP endpoint \n\t* plugin/errors: add stacktrace option to log a stacktrace during panic recovery \n\t* plugin/template: return SERVFAIL for zone-match regex-no-match case \n","status":"published","published":"2024-09-27T14:01:32Z","modified":"2026-02-04T03:04:36.822102Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:12490-1","title":"coredns-1.10.0-1.1 on GA media","description":"These are all security issues fixed in the coredns-1.10.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:29:08.237036Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2025:15510-1","title":"traefik2-2.11.29-1.1 on GA media","description":"These are all security issues fixed in the traefik2-2.11.29-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-01T00:00:00Z","modified":"2026-03-23T04:53:52.66038Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15529-1","title":"traefik-3.5.1-1.1 on GA media","description":"These are all security issues fixed in the traefik-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-05T00:00:00Z","modified":"2026-03-23T04:53:53.887716Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:12166-1","title":"percona-toolkit-3.7.1.4-1.1 on GA media","description":"These are all security issues fixed in the percona-toolkit-3.7.1.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-17T00:00:00Z","modified":"2026-10-18T11:15:03.239912385Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21457-1","title":"Security update for hawk-apiserver","description":"This update for hawk-apiserver fixes the following issues:\n\nChanges in hawk-apiserver:\n\n- Bump ClusterLabs/go-pacemaker v0.0.0-20260609131737-256130b189e0 (bsc#1267454)\n\nVersion 0.1.0+git.1773234993.db3c82f:\n\n  * handle /cib/live/primitives/\u003cresource_id\u003e/edit in hawk-apiserver\n\n- Bump github.com/stretchr/testify.v1.11.0 and gopkg.in/yaml.v3.0.1 (bsc#1248563 CVE-2022-28948)\n\n- Dev: use the newest go-pacemaker and updated ToString (bsc#1237259)\n","status":"published","published":"2026-07-28T08:32:40Z","modified":"2026-07-30T18:24:15.395638504Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2025:02998-1","title":"Security update for ignition","description":"This update for ignition fixes the following issues:\n\n- CVE-2022-28948: Fixed an issue during unmarshaling in Go-Yaml v3 can lead to DoS via invalid input (bsc#1248548)\n","status":"published","published":"2025-08-27T12:04:54Z","modified":"2026-03-23T04:48:42.462217Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02999-1","title":"Security update for ignition","description":"This update for ignition fixes the following issues:\n\n- CVE-2022-28948: Fixed an issue during unmarshaling in Go-Yaml v3 can lead to DoS via invalid input (bsc#1248548)\n","status":"published","published":"2025-08-27T12:05:04Z","modified":"2026-03-23T04:47:56.203361Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03000-1","title":"Security update for ignition","description":"This update for ignition fixes the following issues:\n\n- CVE-2022-28948: Fixed an issue during unmarshaling in Go-Yaml v3 can lead to DoS via invalid input (bsc#1248548)\n","status":"published","published":"2025-08-27T12:05:13Z","modified":"2026-03-23T04:49:51.71288Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03001-1","title":"Security update for ignition","description":"This update for ignition fixes the following issues:\n\n- CVE-2022-28948: Fixed an issue during unmarshaling in Go-Yaml v3 can lead to DoS via invalid input (bsc#1248548)\n","status":"published","published":"2025-08-27T12:05:48Z","modified":"2026-03-23T04:47:00.01431Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2026:22997-1","title":"Security update for hawk-apiserver","description":"This update for hawk-apiserver fixes the following issues:\n\nChanges in hawk-apiserver:\n\n- Bump ClusterLabs/go-pacemaker v0.0.0-20260609131737-256130b189e0 (bsc#1267454)\n\nVersion 0.1.0+git.1773234993.db3c82f:\n\n  * handle /cib/live/primitives/\u003cresource_id\u003e/edit in hawk-apiserver\n\n- Bump github.com/stretchr/testify.v1.11.0 and gopkg.in/yaml.v3.0.1 (bsc#1248563 CVE-2022-28948)\n\n- Dev: use the newest go-pacemaker and updated ToString (bsc#1237259)\n","status":"published","published":"2026-07-28T08:33:36Z","modified":"2026-08-08T18:23:58.443330515Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}