PT-2024-41085 · Yaml · Yaml

Published 2024-09-25 · Updated 2024-09-25

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions The product name cannot be determined.

Description The issue is related to a weakness in the deserialization mechanism of the YAML library in the Go programming language, specifically affecting the Unmarshal function. This weakness can be exploited by a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-02344

Affected Products

Yaml

References · 3

• https://bdu.fstec.ru/vul/2025-02344 · Security Note
• https://github.com/go-yaml/yaml/issues/1050 · Note
• https://github.com/kubernetes-sigs/yaml/issues/117 · Note