Compose-Go Library Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the Compose-Go library, specifically in versions 2.10 through 2.4.0. This vulnerability allows an authorized user to send malicious YAML payloads that cause the library to excessively consume memory and CPU resources while parsing the YAML. This issue affects Docker Compose versions 2.27.0 to 2.29.7.

Impact

Exploitation of this vulnerability leads to a significant denial-of-service condition, causing high resource consumption that can disrupt normal operations.

Remediation

Users can upgrade to Compose-Go version 2.4.1, which addresses this vulnerability.