CVE-2022-28948
HighAdvisory
Published 20 May 2022In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.040
- 90th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 376
- of 17,781 indexed, latest versions
- Container images
- 407
- deployed by those charts
- Fix available
- 1 of 1
- affected package
gopkg.in/yaml.v3 Denial of Service
Carried by container images the latest versions of 376 of 17,781 indexed charts deploy, on 407 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| gopkg.in/ | v3.0.0, v3.0.0-20190924164351-c8b7dadae555, v3.0.0-20191026110619-0b21df46bc1d, v3.0.0-20191120175047-4206685974f2+9 more | 3.0.1 | 407 |
- OSV records
- GHSA-hp87-p4gw-j4gq
- Also known as
- GO-2022-0603
Charts affected
376 by stars
Container images carrying it
407 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| rookout/ | 0d083f3ef1a7 | gopkg.in/ | 3.0.1 | 1 |
| shenxn/ | acf31af7c111 | gopkg.in/ | 3.0.1 | 1 |
| sikalabs/ | fdc0c6711add | gopkg.in/ | 3.0.1 | 1 |
| simpleidserver/ | 25e378d57d78 | gopkg.in/ | 3.0.1 | 1 |
| skylenet/ | 210353ce7c89 | gopkg.in/ | 3.0.1 | 1 |
| slamdev/ | a234541c9fa8 | gopkg.in/ | 3.0.1 | 1 |
| someblackmagic/ | 6eca64b6b440 | gopkg.in/ | 3.0.1 | 1 |
| splunk/ | c4e0d3146226 | gopkg.in/ | 3.0.1 | 1 |
| stakater/ | 450415ce1b4e | gopkg.in/ | 3.0.1 | 1 |
| stakater/ | 3409565b1ef5 | gopkg.in/ | 3.0.1 | 1 |
| stakater/ | 37ce9acf2722 | gopkg.in/ | 3.0.1 | 1 |
| stakkato95/ | 5d48906d66b3 | gopkg.in/ | 3.0.1 | 1 |
| streamnative/ | 11bceacec8fb | gopkg.in/ | 3.0.1 | 1 |
| streamnative/ | 31533fa9fab7 | gopkg.in/ | 3.0.1 | 1 |
| temporalio/ | 35034611d981 | gopkg.in/ | 3.0.1 | 1 |
| temporalio/ | e26758f5a1bf | gopkg.in/ | 3.0.1 | 1 |
| thanosio/ | 88276fcd1491 | gopkg.in/ | 3.0.1 | 1 |
| thanosio/ | b12d5c31bf5a | gopkg.in/ | 3.0.1 | 1 |
| thesisrobot/ | d94c8dbf6dac | gopkg.in/ | 3.0.1 | 1 |
| treeverse/ | 478f37a6cffc | gopkg.in/ | 3.0.1 | 1 |
| twentycrm/ | 2f78405a78be | gopkg.in/ | 3.0.1 | 1 |
| velero/ | 277fbfaf8dcf | gopkg.in/ | 3.0.1 | 1 |
| velero/ | 8d784580931c | gopkg.in/ | 3.0.1 | 1 |
| vikunja/ | 8cba0520bf8c | gopkg.in/ | 3.0.1 | 1 |
| volantmq/ | 9bfe7857ebc3 | gopkg.in/ | 3.0.1 | 1 |
| wavefronthq/ | af5fef9a4768 | gopkg.in/ | 3.0.1 | 1 |
| xingse/ | 9f9d5492e4bf | gopkg.in/ | 3.0.1 | 1 |
| zufardhiyaulhaq/ | 7cf2ae3fb1fb | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | e225fe7eaa55 | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 6937c0a9b203 | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | a4011eae6a0b | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | c552478f8f11 | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 8ab8229f6a89 | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | a84b574e8027 | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | f253b82941c2 | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | a705c1ea8e9e | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 93ff6e693577 | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 007820fdb75b | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 75cfdcfa050a | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 23baa1932232 | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 847bb97e3844 | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 9084ea8498ea | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | dc6ca05bb94f | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 83e79c709df3 | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 00db9796a37b | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 795a0c8a0e13 | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 34403f9f94be | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 6c8e4e2a6443 | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 784518ff3ee7 | gopkg.in/ | 3.0.1 | 1 |
| gcr.io/ | 82940e8c3e0d | gopkg.in/ | 3.0.1 | 1 |