Read the docs
TI-2026-70120 Aliases CVE-2026-107840GHSA-6r69-c6wg-7g8m

yopass metrics middleware lets remote attackers exhaust memory

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

yopass, a service for securely sharing secrets, passwords, and files, is affected before version 14.7.0. Its Prometheus metrics middleware uses the attacker-controlled HTTP method as a metric label, so each unique method name creates a series the registry never removes. An unauthenticated remote attacker can send many unique methods to the catch-all route, causing uncontrolled resource consumption that can exhaust memory and kill the process (CWE-400). The growing registry also slows /metrics scrapes and can blind monitoring.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_http_requests_total and yopass_http_request_duration_seconds. Because the catch-all route accepts arbitrary HTTP method tokens, an unauthenticated remote attacker can submit many unique methods and create metric series that the Prometheus registry never evicts. The resulting monotonic memory growth can OOM-kill the process, while the expanding registry also degrades /metrics scrape latency and can blind monitoring. This issue is fixed in version 14.7.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00444 38th percentileScored 2026-11-07
Fix Fixed yopass (jhaals): 14.7.0github.com/jhaals/yopass (Go): 0.0.0-20260727191436-61e31ead04a4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jhaalsyopassbefore 14.7.014.7.0Patch availableCNA
—github.com/jhaals/yopass (Go)before 0.0.0-20260727191436-61e31ead04a40.0.0-20260727191436-61e31ead04a4Patch availableGHSA-6r69-c6wg-7g8m
  • yopass Vendorjhaals Affected before 14.7.0 Fixed in 14.7.0 Patch available CNA
  • github.com/jhaals/yopass (Go) Vendor— Affected before 0.0.0-20260727191436-61e31ead04a4 Fixed in 0.0.0-20260727191436-61e31ead04a4 Patch available GHSA-6r69-c6wg-7g8m

Remediation

Upgrade yopass to version 14.7.0. The Go module github.com/jhaals/yopass is fixed in version 0.0.0-20260727191436-61e31ead04a4. Red Hat marks one product as not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA yopass (jhaals) Fixed in 14.7.0
  • Fix · GHSA-6r69-c6wg-7g8m github.com/jhaals/yopass (Go) Fixed in 0.0.0-20260727191436-61e31ead04a4 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-107840
  2. 2026-10-10 Alias added: GHSA-6r69-c6wg-7g8m
  3. 2026-10-10 Fix available: Go/github.com/jhaals/[email protected] · GHSA-6r69-c6wg-7g8m
  4. 2026-10-10 CVSS score added · GHSA-6r69-c6wg-7g8m
  5. 2026-10-10 Weakness changed · GHSA-6r69-c6wg-7g8m
  6. 2026-10-10 7 new references · GHSA-6r69-c6wg-7g8m
  7. 2026-11-06 Affected versions changed · Red Hat
  8. 2026-11-06 CVSS score added · Red Hat

References

Advisory 1

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences