yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-107840 · Microsoft / collected KEV context

EUVD-2026-95935

GHSA-6r69-c6wg-7g8m

GO-2026-6720

cve-program · CVE-2026-107840

• https://github.com/jhaals/yopass/security/advisories/GHSA-6r69-c6wg-7g8m
• https://github.com/jhaals/yopass/pull/3773
• https://github.com/jhaals/yopass/commit/61e31ead04a4fc27ce80bed226af41c7c0426ccf
• https://github.com/jhaals/yopass/commit/78d0c14f7085048130199662a2ec8a18ec8d6ebb
• https://github.com/jhaals/yopass/releases/tag/14.7.0

euvd · EUVD-2026-95935

• https://github.com/jhaals/yopass/security/advisories/GHSA-6r69-c6wg-7g8m
• https://github.com/jhaals/yopass/pull/3773
• https://github.com/jhaals/yopass/commit/61e31ead04a4fc27ce80bed226af41c7c0426ccf
• https://github.com/jhaals/yopass/commit/78d0c14f7085048130199662a2ec8a18ec8d6ebb
• https://github.com/jhaals/yopass/releases/tag/14.7.0

nvd · CVE-2026-107840

• https://github.com/jhaals/yopass/commit/61e31ead04a4fc27ce80bed226af41c7c0426ccf
• https://github.com/jhaals/yopass/commit/78d0c14f7085048130199662a2ec8a18ec8d6ebb
• https://github.com/jhaals/yopass/pull/3773
• https://github.com/jhaals/yopass/releases/tag/14.7.0
• https://github.com/jhaals/yopass/security/advisories/GHSA-6r69-c6wg-7g8m

osv · GHSA-6r69-c6wg-7g8m

• https://github.com/jhaals/yopass/security/advisories/GHSA-6r69-c6wg-7g8m
• https://nvd.nist.gov/vuln/detail/CVE-2026-107840
• https://github.com/jhaals/yopass/pull/3773
• https://github.com/jhaals/yopass/commit/61e31ead04a4fc27ce80bed226af41c7c0426ccf
• https://github.com/jhaals/yopass/commit/78d0c14f7085048130199662a2ec8a18ec8d6ebb
• https://github.com/jhaals/yopass
• https://github.com/jhaals/yopass/releases/tag/14.7.0

osv · GO-2026-6720

• https://github.com/jhaals/yopass/security/advisories/GHSA-6r69-c6wg-7g8m
• https://nvd.nist.gov/vuln/detail/CVE-2026-107840
• https://github.com/jhaals/yopass/commit/61e31ead04a4fc27ce80bed226af41c7c0426ccf
• https://github.com/jhaals/yopass/commit/78d0c14f7085048130199662a2ec8a18ec8d6ebb
• https://github.com/jhaals/yopass/pull/3773
• https://github.com/jhaals/yopass/releases/tag/14.7.0

No related operational record is retained in the current change model.