CVE-2024-10846

MEDIUM

compose-go 2.1.0-2.4.0 - Authenticated Denial of Service via Malicious YAML Payload

Title source: llm
STIX 2.1

Description

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included

References (2)

Core 2

Scores

CVSS v3 5.9
EPSS 0.0022
EPSS Percentile 12.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-20
Status published
Products (2)
compose-spec/compose-go < 2.4.0
compose-spec/compose-go 2.1.0 - 2.4.1Go
Published Jan 23, 2025
Tracked Since Feb 18, 2026