jhaals vulnerabilities

Products

• github.com/jhaals/yopass 1

Latest jhaals CVEs

Newest publication first

1. CVE-2026-107840 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

   Published 2026-10-09

   High·CVSS 7.5 EPSS 0.44%

   yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_http_requests_total and yopass_http_reque...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.