Vulnpedia
← Search CVEs

CVE-2026-107840

HIGH 7.5

Published 2026-10-09 · Last modified 2026-10-09

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_http_requests_total and yopass_http_request_duration_seconds. Because the catch-all route accepts arbitrary HTTP method tokens, an unauthenticated remote attacker can submit many unique methods and create metric series that the Prometheus registry never evicts. The resulting monotonic memory growth can OOM-kill the process, while the expanding registry also degrades /metrics scrape latency and can blind monitoring. This issue is fixed in version 14.7.0.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 38th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Jhaals

Products Yopass

Weakness (CWE)

  • CWE-400: : Uncontrolled Resource Consumption

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • github.com/jhaals/yopass Go

    pkg:golang/github.com/jhaals/yopass

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.0.0-20260727191436-61e31ead04a4
    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6r69-c6wg-7g8m/GHSA-6r69-c6wg-7g8m.json"
  }
}
    GitHub Advisory Database · GHSA-6r69-c6wg-7g8m · Updated 2026-10-19T21:41:22.334512920Z
  • github.com/jhaals/yopass Go

    pkg:golang/github.com/jhaals/yopass

    SEMVER range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 0.0.0-20260727191436-61e31ead04a4
    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://vuln.go.dev/ID/GO-2026-6720.json"
  }
}
    Go Vulnerability Database · GO-2026-6720 · Updated 2026-10-19T21:31:52.276950050Z

All CVSS metrics

  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS