-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/compose-spec/compose-go/v2 | go | >= 2.1.0, < 2.4.1 | 2.4.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of YAML aliases/anchors during unmarshalling. The linked PRs (#618 and #703) show fixes in reset.go adding cycle detection and alias resolution checks. The processReset function was identified as the location where recursive YAML structures were not properly validated, leading to infinite loops. The addition of a 'visited' map in PR #703 to track processed nodes confirms this was the vulnerable area. The CWE-400 (Resource Consumption) mapping aligns with the loop-based resource exhaustion described in the advisory.
KEV Misses 88% of Exploited CVEs- Get the report