CVE-2024-10846

Published: Jan 23, 2025Modified: Jun 17, 2026Deferred

5.9

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H

Exploitability: 1.5 / Impact: 4.0

Source: security@docker.com (Secondary)

Description

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://github.com/compose-spec/compose-go/security/advisories/GHSA-36gq-35j3-p9r9

Source: security@docker.com

https://security.netapp.com/advisory/ntap-20250425-0008/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.