CVE-2026-107840: CWE-400: Uncontrolled Resource Consumption in jhaals yopass

CVE-2026-107840 is an uncontrolled resource consumption vulnerability (CWE-400) in the Prometheus metrics middleware of yopass prior to version 14.7.0. The middleware uses the attacker-controlled HTTP method value (r.Method) directly as a label for Prometheus metrics (yopass_http_requests_total and yopass_http_request_duration_seconds). Since the catch-all route accepts arbitrary HTTP method tokens, an unauthenticated remote attacker can submit many unique HTTP methods, creating numerous metric series that the Prometheus registry never evicts. This causes monotonic memory growth that can lead to out-of-memory (OOM) kills of the yopass process and degrades the latency of /metrics scraping, potentially blinding monitoring systems. The vulnerability is resolved in version 14.7.0.

An unauthenticated remote attacker can cause the yopass service to consume increasing amounts of memory by submitting many unique HTTP methods, leading to potential out-of-memory kills of the service process. This disrupts service availability and degrades monitoring by increasing scrape latency and potentially blinding Prometheus-based monitoring systems. There is no impact on confidentiality or integrity reported.

Upgrade yopass to version 14.7.0 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed fixed in version 14.7.0.