CVE-2026-107840
Description
A flaw was found in yopass. The application records user-supplied HTTP request methods directly into its monitoring metrics registry without proper validation. An unauthenticated remote attacker can exploit this issue by submitting requests with numerous unique HTTP methods, triggering continuous memory growth that can lead to an out-of-memory crash. This vulnerability primarily results in a Denial of Service (DoS) and impaired service monitoring.
Statement
Red Hat Product Security rates this vulnerability as Important because remote, unauthenticated attackers can cause complete service termination through unbounded memory consumption without requiring privileges or user interaction. While this flaw presents a severe denial-of-service risk to affected instances exposing Prometheus telemetry, the yopass package is not included or supported in Red Hat enterprise software offerings. As a result, default Red Hat deployments remain unaffected by this flaw.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
