Docker · Docker Compose · CVE-2024-10846
**Name of the Vulnerable Software and Affected Versions**
compose-go versions v2.10 through v2.4.0
Docker Compose versions v2.27.0 through v2.29.7
**Description**
The issue allows an authorized user who sends malicious YAML payloads to cause excessive memory and CPU cycle consumption while parsing YAML. This affects the compose-go library, which is used by Docker Compose.
**Recommendations**
For compose-go versions v2.10 through v2.4.0, update to version v2.24.1 to fix the issue.
For Docker Compose versions v2.27.0 through v2.29.7, consider updating the underlying compose-go library to version v2.24.1 as a mitigation measure.
As a temporary workaround, consider restricting the use of YAML payloads to trusted sources until the issue is resolved.