CVE catalog

CVE-2022-28948

golang-gopkg-yaml.v3: CVE-2022-28948

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
3.96% · Oct 25, 2026

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-gopkg-yaml.v3sid3.0.5-1fixed
Debiangolang-gopkg-yaml.v3forky3.0.5-1fixed
Debiangolang-gopkg-yaml.v3trixie3.0.1-3fixed
Debiangolang-gopkg-yaml.v3bookworm3.0.1-3fixed
Susehawk-apiserverlinux enterprise high availability extension 16.00.1.0+git.1781014483.1c464f2-160000.1.1fixed
Opensusehawk-apiserverleap 16.00.1.0+git.1781014483.1c464f2-160000.1.1fixed
Ubuntusnapdpro2.28.5+17.10vulnerable
Ubuntusnapdpro2.29.4.1+18.04vulnerable
Ubuntusnapdpro2.29.4.2+18.04vulnerable
Ubuntusnapdpro2.31.1+18.04vulnerable
Ubuntusnapdpro2.32+18.04~pre5vulnerable
Ubuntusnapdpro2.32+18.04~pre6vulnerable
Ubuntusnapdpro2.32+18.04vulnerable
Ubuntusnapdpro2.32.3.2+18.04vulnerable
Ubuntusnapdpro2.32.5+18.04vulnerable
Ubuntusnapdpro2.32.8+18.04vulnerable
Ubuntusnapdpro2.32.9+18.04vulnerable
Ubuntusnapdpro2.33.1+18.04ubuntu2vulnerable
Ubuntusnapdpro2.34.2+18.04vulnerable
Ubuntusnapdpro2.34.2+18.04.1vulnerable
Ubuntusnapdpro2.37.1+18.04vulnerable
Ubuntusnapdpro2.37.1.1+18.04vulnerable
Ubuntusnapdpro2.37.4+18.04vulnerable
Ubuntusnapdpro2.37.4+18.04.1vulnerable
Ubuntusnapdpro2.38+18.04vulnerable
Ubuntusnapdpro2.39.2+18.04vulnerable
Ubuntusnapdpro2.40+18.04vulnerable
Ubuntusnapdpro2.42.1+18.04vulnerable
Ubuntusnapdpro2.45.1+18.04vulnerable
Ubuntusnapdpro2.45.1+18.04.2vulnerable
Ubuntusnapdpro2.46.1+18.04vulnerable
Ubuntusnapdpro2.47.1+18.04vulnerable
Ubuntusnapdpro2.48+18.04vulnerable
Ubuntusnapdpro2.48.3+18.04vulnerable
Ubuntusnapdpro2.49.2+18.04vulnerable
Ubuntusnapdpro2.51.1+18.04vulnerable
Ubuntusnapdpro2.54.2+18.04ubuntu1vulnerable
Ubuntusnapdpro2.54.3+18.04vulnerable
Ubuntusnapdpro2.54.3+18.04.2ubuntu0.1vulnerable
Ubuntusnapdpro2.54.3+18.04.2ubuntu0.2vulnerable
Ubuntusnapdpro2.55.5+18.04vulnerable
Ubuntusnapdpro2.57.5+18.04vulnerable
Ubuntusnapdpro2.57.5+18.04ubuntu0.1vulnerable
Ubuntusnapdpro2.58+18.04vulnerable
Ubuntusnapdpro2.58+18.04.1vulnerable
Ubuntusnapdpro2.61.4ubuntu0.18.04.1+esm1vulnerable
Ubuntusnapdpro2.61.4ubuntu0.18.04.1+esm2vulnerable
Ubuntusnapdpro2.61.4ubuntu0.18.04.1+esm4vulnerable
Ubuntusnapd20.042.41+19.10.1vulnerable
Ubuntusnapd20.042.42.1+20.04vulnerable
Ubuntusnapd20.042.43.3+git1.8109f8vulnerable
Ubuntusnapd20.042.44~pre1+20.04vulnerable
Ubuntusnapd20.042.44+20.04vulnerable
Ubuntusnapd20.042.44.2+20.04vulnerable
Ubuntusnapd20.042.44.3+20.04vulnerable
Ubuntusnapd20.042.45.1+20.04vulnerable
Ubuntusnapd20.042.45.1+20.04.2vulnerable
Ubuntusnapd20.042.46.1+20.04vulnerable
Ubuntusnapd20.042.47.1+20.04vulnerable
Ubuntusnapd20.042.48+20.04vulnerable
Ubuntusnapd20.042.48.3+20.04vulnerable
Ubuntusnapd20.042.49.2+20.04vulnerable
Ubuntusnapd20.042.51.1+20.04ubuntu2vulnerable
Ubuntusnapd20.042.54.2+20.04ubuntu2vulnerable
Ubuntusnapd20.042.54.3+20.04vulnerable
Ubuntusnapd20.042.54.3+20.04.1vulnerable
Ubuntusnapd20.042.54.3+20.04.1ubuntu0.1vulnerable
Ubuntusnapd20.042.54.3+20.04.1ubuntu0.2vulnerable
Ubuntusnapd20.042.54.3+20.04.1ubuntu0.3vulnerable
Ubuntusnapd20.042.55.5+20.04vulnerable
Ubuntusnapd20.042.57.5+20.04vulnerable
Ubuntusnapd20.042.57.5+20.04ubuntu0.1vulnerable
Ubuntusnapd20.042.58+20.04vulnerable
Ubuntusnapd20.042.58+20.04.1vulnerable
Ubuntusnapd20.042.61.3+20.04vulnerable
Ubuntusnapd20.042.62+20.04vulnerable
Ubuntusnapd20.042.63+20.04vulnerable
Ubuntusnapd20.042.63+20.04ubuntu0.1fixed
Ubuntugolang-gopkg-yaml.v322.043.0.0~git20200121.a6ecf24-3vulnerable
Ubuntugolang-gopkg-yaml.v322.043.0.0~git20210107.496545a-1vulnerable
Ubuntusnapd22.042.53+21.10ubuntu1vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu1vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu2vulnerable
Ubuntusnapd22.042.54.2+22.04ubuntu3vulnerable
Ubuntusnapd22.042.54.3+git19.g868fc21+22.04vulnerable
Ubuntusnapd22.042.54.3+git26.g360067e+22.04vulnerable
Ubuntusnapd22.042.55.2+22.04vulnerable
Ubuntusnapd22.042.55.2+22.04.1vulnerable
Ubuntusnapd22.042.55.3+22.04vulnerable
Ubuntusnapd22.042.55.3+22.04ubuntu1vulnerable
Ubuntusnapd22.042.55.5+22.04vulnerable
Ubuntusnapd22.042.56.2+22.04ubuntu1vulnerable
Ubuntusnapd22.042.57.4+22.04vulnerable
Ubuntusnapd22.042.57.5+22.04vulnerable
Ubuntusnapd22.042.57.5+22.04ubuntu0.1vulnerable
Ubuntusnapd22.042.58+22.04vulnerable
Ubuntusnapd22.042.58+22.04.1vulnerable
Ubuntusnapd22.042.61.3+22.04vulnerable
Ubuntusnapd22.042.62+22.04vulnerable
Ubuntusnapd22.042.63+22.04vulnerable
Ubuntusnapd22.042.63+22.04ubuntu0.1fixed
Ubuntusnapd24.042.60.4+23.10vulnerable
Ubuntusnapd24.042.61.3+24.04vulnerable
Ubuntusnapd24.042.62+24.04build1fixed
Opensusetraefiktumbleweed3.5.1-1.1fixed
Opensusetraefik2tumbleweed2.11.29-1.1fixed
Suseignitionlinux enterprise micro 5.22.14.0-150300.6.16.1fixed
Suseignitionlinux enterprise micro 5.12.14.0-150300.4.16.1fixed
Suseignitionlinux enterprise micro 5.32.14.0-150400.4.12.1fixed
Suseignitionlinux enterprise module for hpc 15 sp62.14.0-150400.9.12.1fixed
Suseignitionlinux enterprise module for hpc 15 sp72.14.0-150400.9.12.1fixed
Opensuseignitionleap 15.62.14.0-150400.9.12.1fixed
Opensusepercona-toolkittumbleweed3.7.1.4-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-gopkg-yaml.v3sourcesid3.0.1-1not yet assignedNot reported[1011338]
Debiangolang-gopkg-yaml.v3sourceforky3.0.1-1not yet assignedNot reported[1011338]
Debiangolang-gopkg-yaml.v3sourcetrixie3.0.1-1not yet assignedNot reported[1011338]
Debiangolang-gopkg-yaml.v3sourcebookworm3.0.1-1not yet assignedNot reported[1011338]
Susehawk-apiserverrpmlinux enterprise high availability extension 16.00.1.0+git.1781014483.1c464f2-160000.1.1Not reportedSUSE-SU-2026:22997-1Not reported
Opensusehawk-apiserverrpmleap 16.00.1.0+git.1781014483.1c464f2-160000.1.1Not reportedOPENSUSE-SU-2026:21457-1Not reported
Ubuntusnapddeb20.042.63+20.04ubuntu0.1Not reportedUBUNTU-CVE-2022-28948Not reported
Ubuntusnapddeb22.042.63+22.04ubuntu0.1Not reportedUBUNTU-CVE-2022-28948Not reported
Ubuntusnapddeb24.042.62+24.04build1Not reportedUBUNTU-CVE-2022-28948Not reported
Opensusetraefikrpmtumbleweed3.5.1-1.1Not reportedOPENSUSE-SU-2025:15529-1Not reported
Opensusetraefik2rpmtumbleweed2.11.29-1.1Not reportedOPENSUSE-SU-2025:15510-1Not reported
Suseignitionrpmlinux enterprise micro 5.22.14.0-150300.6.16.1Not reportedSUSE-SU-2025:03000-1Not reported
Suseignitionrpmlinux enterprise micro 5.12.14.0-150300.4.16.1Not reportedSUSE-SU-2025:02998-1Not reported
Suseignitionrpmlinux enterprise micro 5.32.14.0-150400.4.12.1Not reportedSUSE-SU-2025:02999-1Not reported
Suseignitionrpmlinux enterprise module for hpc 15 sp62.14.0-150400.9.12.1Not reportedSUSE-SU-2025:03001-1Not reported
Suseignitionrpmlinux enterprise module for hpc 15 sp72.14.0-150400.9.12.1Not reportedSUSE-SU-2025:03001-1Not reported
Opensuseignitionrpmleap 15.62.14.0-150400.9.12.1Not reportedSUSE-SU-2025:03001-1Not reported
Opensusepercona-toolkitrpmtumbleweed3.7.1.4-1.1Not reportedOPENSUSE-SU-2026:12166-1Not reported

[Debian bug #1011338]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [golang-gopkg-yaml.v3-dev]Unknown

    Source package: [golang-gopkg-yaml.v3]

    Details (2)

    • 3.0.1-3 · all · bookworm

      Fixed · Fixed: 3.0.1-1

      dsa · golang-gopkg-yaml.v3 · debian · bookworm

    • 3.0.1-3 · all · bookworm

      Fixed · Fixed: 3.0.1-1

      dsa · golang-gopkg-yaml.v3 · debian · bookworm

[openSUSE Tumbleweed]

  • [traefik]Unknown

    Source package: [traefik]

    Details (1)

    • 3.7.12-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 3.5.1-1.1

      dsa · traefik · opensuse · tumbleweed

  • [traefik2]Unknown

    Source package: [traefik2]

    Details (1)

    • 2.11.56-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 2.11.29-1.1

      dsa · traefik2 · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]