GHSA-6r69-c6wg-7g8m: High severity go/github.com/jhaals/yopass vulnerability
The Prometheus metrics middleware in pkg/server/server.go used r.Method directly as a label value on request counter and duration histogram metrics. Since the mux catch-all route matches any HTTP method, an unauthenticated attacker can send requests with arbitrary method strings (e.g. curl -X "M1" http://host/), each creating new counter and histogram time series in the Prometheus registry. The registry's internal maps never evict entries.
An attacker issuing requests with unique method values causes monotonic memory growth until the process is OOM-killed. Additionally, /metrics scrape latency degrades proportionally, eventually timing out and blinding monitoring.
Remediation: Upgrade to 14.7.0 or later, which clamps the method label to a fixed allowlist (GET, POST, PUT, DELETE, OPTIONS, HEAD, CONNECT, TRACE) and maps everything else to other.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/jhaals/yopassto a version that resolves this vulnerability.Fixed in 0.0.0-20260727191436-61e31ead04a4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated network client that can send HTTP requests to the affected service can exploit it. The attacker does not need valid credentials or user interaction, and can use arbitrary HTTP method strings.
What operational impact should be expected during an attack?
Each unique method value creates persistent Prometheus counter and histogram time series that are not evicted, causing memory use to grow until the process is OOM-killed. Prometheus /metrics scrapes also become progressively slower and may time out, impairing monitoring.
What should be done if an immediate upgrade is not possible?
Restrict untrusted network access to the service so attackers cannot submit arbitrary HTTP requests. In particular, limit exposure to clients that require access until upgrading to version 14.7.0 or later.
How can I determine whether the service has been targeted?
Look for unusually high cardinality in Prometheus request counter and duration histogram metrics, especially label values containing unexpected HTTP methods. Growing process memory and increasingly slow or timing-out /metrics scrapes are also indicators.