Skip to content
OpenAdvisories

Package · Go

github.com/jhaals/yopass

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.5
    CVE-2026-107840

    yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

    yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_http_requests_total …

    jhaals yopass github.com/jhaals/yopass Go