Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/compose-spec/compose-go/v2

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9GoPublished

    Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop

    CVE-2024-10846 · GHSA-36gq-35j3-p9r9

    Affected
    • Go github.com/compose-spec/compose-go/v2 >= 2.1.0, < 2.4.1
    Fixed in
    2.4.1· Vendor fix available
    Issue
    Impact The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included Patches compose-go v2.24.1 fixed the issue Workarounds There isn't any known workaround. References https://github.com/docker/compose/issues/12235 https://github.com/compose-spec/compose-go/pull/703 https://github.com/compose-spec/compose-go/pull/618 https://github.com/docker/compose/commit/d239f0f3187a2ed5404c61f83bd5e995c81600ff#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6R10

    Recommended action: Upgrade to 2.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →