Yopass CVE-2026-107840

Requires a network-reachable yopass instance prior to version 14.7.0 with the Prometheus metrics middleware active (the default server path in pkg/server/server.go) and the catch-all route accepting arbitrary HTTP method tokens. No authentication, no user interaction, and no non-default configuration are needed - exploitation works against default configurations. The practical LIMITING factor is that impact is cumulative, not instantaneous: the attacker must sustain a high volume of requests with many thousands of distinct method tokens to grow the registry enough to OOM the host, so available process memory, request-rate limits, or a fronting proxy that normalizes/rejects non-standard HTTP methods can slow or blunt the attack.

All signals point to an availability-only denial-of-service with no confidentiality or integrity impact. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) is internally consistent with the description: an unauthenticated remote attacker, over the network, with low complexity and no user interaction, can exhaust process memory. The A:H rating drives the entire score - there is genuinely zero C/I impact (CWE-400, resource exhaustion). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or likely imminent exploitation; exploitation status is 'no public exploit identified at time of analysis.' The one tempering factor the raw 7.5 hides is that this is a slow-burn, stateful attack: a single request does nothing, and impact accrues only from sustained submission of many thousands of unique HTTP method tokens to inflate Prometheus label cardinality until OOM. The root cause is confirmed by the vendor fix commit, which collapses unknown methods into a single series. Net: a legitimate HIGH-severity availability bug, but its real-world priority is moderated by low product prevalence and the absence of any exploitation signal - patch on a normal cadence rather than as an emergency.

An unauthenticated attacker repeatedly sends HTTP requests to a public yopass instance, each using a unique, arbitrary method token (e.g. FOO1, FOO2, ... FOOn) against the catch-all route. Each distinct token creates a new, never-evicted Prometheus metric series for yopass_http_requests_total and yopass_http_request_duration_seconds, causing unbounded memory growth that eventually OOM-kills the process while also degrading /metrics scrape latency and blinding monitoring. No public exploit code was identified, but the attack requires only a trivial scripted loop of HTTP requests with varied method verbs.