CVE-2026-107840 Details
Description
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_http_requests_total and yopass_http_request_duration_seconds. Because the catch-all route accepts arbitrary HTTP method tokens, an unauthenticated remote attacker can submit many unique methods and create metric series that the Prometheus registry never evicts. The resulting monotonic memory growth can OOM-kill the process, while the expanding registry also degrades /metrics scrape latency and can blind monitoring. This issue is fixed in version 14.7.0.
A high-severity vulnerability has been identified in Yopass, a service for securely sharing secrets, passwords, and files, prior to version 14.7.0. The issue arises in the Prometheus metrics middleware, where the HTTP method value is used directly as a label for request counters and duration metrics. This vulnerability allows an unauthenticated remote attacker to send requests with arbitrary HTTP methods, creating an unbounded number of metric series that consume server memory. The resulting memory exhaustion can lead to the process being killed by the operating system, while also degrading the performance of metrics scraping and monitoring.
Upgrade to Yopass version 14.7.0 or later, which fixes the vulnerability by clamping the HTTP method label to a fixed allowlist and mapping all other methods to a generic 'other' label.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jhaals/yopass/commit/61e31ead04a4fc27ce80bed226af41c7c0426ccf | [email protected] | Source CodeVendor |
| https://github.com/jhaals/yopass/commit/78d0c14f7085048130199662a2ec8a18ec8d6ebb | [email protected] | Source CodeVendor |
| https://github.com/jhaals/yopass/pull/3773 | [email protected] | Source CodeVendor |
| https://github.com/jhaals/yopass/releases/tag/14.7.0 | [email protected] | Release NotesVendor |
| https://github.com/jhaals/yopass/security/advisories/GHSA-6r69-c6wg-7g8m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jhaals yopass | < 14.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |