CVE-2024-10846

Severity CVSS v4.0:

Pending analysis

Type:

CWE-20 Input Validation

Publication date:

23/01/2025

Last modified:

15/04/2026

Description

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included

Impact

Vector 3.x

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H CVSS v3.1 Severity and Metrics:

Base Score: 5.90 MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H

Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope (S): Changed
Confidentiality (C): None
Integrity (I): None
Availability (A): High

Base Score 3.x

5.90

Severity 3.x

MEDIUM

References to Advisories, Solutions, and Tools

https://github.com/compose-spec/compose-go/security/advisories/GHSA-36gq-35j3-p9r9
https://security.netapp.com/advisory/ntap-20250425-0008/