CVSS 3.1
5.9 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:HCVE-2024-10846
Medium (5.9). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/compose-spec/compose-go/v2 2.4.1.
The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-36gq-35j3-p9r9 | Go | github.com/compose-spec/compose-go/v2 | >=2.1.0 <2.4.1 | 2.4.1 |
| GO-2025-3412 | Go | github.com/compose-spec/compose-go/v2 | >=2.1.0 <2.4.1 | 2.4.1 |