CVE-2026-107840: yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels
The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and duration histogram metrics. Since the mux catch-all route matches any HTTP method, an unauthenticated attacker can send requests with arbitrary method strings (e.g. curl -X "M1" http://host/), each creating new counter and histogram time series in the Prometheus registry. The registry's internal maps never evict entries.
An attacker issuing requests with unique method values causes monotonic memory growth until the process is OOM-killed. Additionally, /metrics scrape latency degrades proportionally, eventually timing out and blinding monitoring.
Remediation: Upgrade to 14.7.0 or later, which clamps the method label to a fixed allowlist (GET, POST, PUT, DELETE, OPTIONS, HEAD, CONNECT, TRACE) and maps everything else to other.
Other sources
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds. Because the catch-all route accepts arbitrary HTTP method tokens, an unauthenticated remote attacker can submit many unique methods and create metric series that the Prometheus registry never evicts. The resulting monotonic memory growth can OOM-kill the process, while the expanding registry also degrades /metrics scrape latency and can blind monitoring. This issue is fixed in version 14.7.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/jhaals/yopassto a version that resolves this vulnerability.Fixed in 0.0.0-20260727191436-61e31ead04a4 - Upgrade
Upgrade
yopassto a version that resolves this vulnerability.Fixed in 14.7.0
Event History
Frequently Asked Questions
Which deployments are exposed?
yopass versions prior to 14.7.0 are affected if their Prometheus metrics middleware is reachable through the service's HTTP handling. The catch-all route accepts arbitrary HTTP method tokens, allowing remote requests to create new metric-label values.
Does exploitation require authentication or user interaction?
No. An unauthenticated remote attacker can exploit the issue by sending many requests with distinct HTTP method values; no user interaction is required.
What is the operational impact of exploitation?
Each unique method can create metric series that are not evicted from the Prometheus registry, causing monotonically increasing memory use. This can OOM-kill the process and increase /metrics scrape latency, potentially impairing monitoring.
What version fixes the issue?
The issue is fixed in yopass version 14.7.0.