CVE-2024-10846

EUVD-2025-0125
The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions  v2.27.0 to v2.29.7 included
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 12%
Azure Linux logo
Azure Linux Releases
Azure Package
Release
docker-compose
Azure Linux 3.0
0:2.27.0-4.azl3
fixed
Common Weakness Enumeration
References
https://github.com/compose-spec/compose-go/security/advisories/GHSA-36gq-35j3-p9r9
https://security.netapp.com/advisory/ntap-20250425-0008/