What is GHSA-hp87-p4gw-j4gq?

GHSA-hp87-p4gw-j4gq is a security advisory published by GitHub Security Advisories with High severity. gopkg.in/yaml.v3 Denial of Service

Which CVE IDs does GHSA-hp87-p4gw-j4gq cover?

GHSA-hp87-p4gw-j4gq covers the following CVE IDs: CVE-2022-28948. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hp87-p4gw-j4gq?

GHSA-hp87-p4gw-j4gq has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-hp87-p4gw-j4gq?

GHSA-hp87-p4gw-j4gq affects 1 product, including: go/gopkg.in/yaml.v3:\u003c 3.0.1.

GHSA-hp87-p4gw-j4gqHighCVSS 7.5

gopkg.in/yaml.v3 Denial of Service

Vendor

GitHub Security Advisories

Published

May 20, 2022

Last Modified

August 27, 2025

🔗 CVE IDs covered (1)

CVE-2022-28948 →

📋 Description

An issue in the Unmarshal function in Go-Yaml v3 can cause a program to panic when attempting to deserialize invalid input.

🎯 Affected products1

go/gopkg.in/yaml.v3:< 3.0.1

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2022-28948
https://github.com/go-yaml/yaml/issues/666
https://github.com/go-yaml/yaml/commit/8f96da9f5d5eff988554c1aae1784627c4bf6754
https://security.netapp.com/advisory/ntap-20220923-0006
https://github.com/go-yaml/yaml/issues/665
https://github.com/go-yaml/yaml/commit/f6f7691b1fdeb513f56608cd2c32c51f8194bf51
https://github.com/advisories/GHSA-hp87-p4gw-j4gq