Description

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included

INFO

Published Date :

2025-01-23T15:22:56.170Z

Last Modified :

2025-04-25T23:02:53.505Z

Source :

Docker
AFFECTED PRODUCTS

The following products are affected by CVE-2024-10846 vulnerability.

No data.

REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-10846.

URL Resource
https://github.com/compose-spec/compose-go/security/advisories/GHSA-36gq-35j3-p9r9 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20250425-0008/ cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact