PT-2025-1609 · Docker+1 · Docker Compose+1

Ahollmann · Published 2025-01-21 · Updated 2025-04-25 · CVE-2024-10846

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions compose-go versions v2.10 through v2.4.0 Docker Compose versions v2.27.0 through v2.29.7

Description The issue allows an authorized user who sends malicious YAML payloads to cause excessive memory and CPU cycle consumption while parsing YAML. This affects the compose-go library, which is used by Docker Compose.

Recommendations For compose-go versions v2.10 through v2.4.0, update to version v2.24.1 to fix the issue. For Docker Compose versions v2.27.0 through v2.29.7, consider updating the underlying compose-go library to version v2.24.1 as a mitigation measure. As a temporary workaround, consider restricting the use of YAML payloads to trusted sources until the issue is resolved.

Fix

DoS

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

AZL-55947

CVE-2024-10846

GHSA-36GQ-35J3-P9R9

GO-2025-3412

OPENSUSE-SU-2025:14728-1

OPENSUSE-SU-2025_0429-1

SUSE-SU-2025:0429-1

Affected Products

Docker Compose

Suse

References · 47

• https://nvd.nist.gov/vuln/detail/CVE-2024-10846 · Security Note
• https://osv.dev/vulnerability/GHSA-36gq-35j3-p9r9 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-55947 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0429-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14728-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3412 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-10846 · Vendor Advisory
• https://github.com/docker/compose/commit/d239f0f3187a2ed5404c61f83bd5e995c81600ff · Note
• https://github.com/docker/compose/issues/12235 · Note
• https://github.com/docker/compose/commit/d239f0f3187a2ed5404c61f83bd5e995c81600ff#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6R10 · Note
• https://github.com/compose-spec/compose-go/security/advisories/GHSA-36gq-35j3-p9r9 · Note
• https://github.com/compose-spec/compose-go/pull/618 · Note
• https://github.com/compose-spec/compose-go/pull/703 · Note
• https://github.com/compose-spec/compose-go · Note
• https://suse.com/security/cve/CVE-2025-24369 · Note