GO-2026-6720 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels in github.com/jhaals/yopass

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels in github.com/jhaals/yopass...

PT-2026-118036

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels in github.com/jhaals/yopass...

Denial Of Service (DoS)

github.com/jhaals/yopass is vulnerable to denial of service DoS. The vulnerability is due to the use of attacker-controlled HTTP method values as metric labels without validation, which allows an unauthenticated remote attacker to create numerous unique metric series, causing excessive memory...

GHSA-6R69-C6WG-7G8M yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and duration histogram metrics. Since the mux catch-all route matches any HTTP method, an unauthenticated attacker can send requests with arbitrary method strings e.g. curl -X "M1"...

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and duration histogram metrics. Since the mux catch-all route matches any HTTP method, an unauthenticated attacker can send requests with arbitrary method strings e.g. curl -X "M1"...

CVE-2026-107840

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107840 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107840

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107840 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107840 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107840

The yopass secret-sharing service is vulnerable to a memory exhaustion attack in versions prior to 14.7.0 . The root cause lies in the Prometheus metrics middleware within pkg/server/server.go, which uses the attacker-controlled r.Method value as a label for yopass_http_requests_total and yopass_...

EUVD-2026-95935

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

PT-2026-109293

Name of the Vulnerable Software and Affected Versions yopass versions prior to 14.7.0 Description The Prometheus metrics middleware in pkg/server/server.go uses the r.Method value directly as a label for the yopass http requests total and yopass http request duration seconds metrics. Because the...

CVE-2026-107840: Uncontrolled Resource Consumption

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

Yopass Panel - Detect

Yopass panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Yopass panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Yopass Panel - Detect', 'description': 'Yopass panel was detected.',...