VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/compose-spec/compose-go/v2: vulnerability history, versions and safety

github.com/compose-spec/compose-go/v2 is a package in the Go ecosystem. Vulert records 2 vulnerabilities for it across 0 release, first recorded in Jan 2025. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
2 vulnerabilities recorded M1 U1
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/compose-spec/compose-go/v2 vulnerabilities

Vulert verdict on github.com/compose-spec/compose-go/v2 v2.16.2 i

Updated on 23 Oct 2026

Good news: v2.16.2, the version you would install today, has no known vulnerabilities. Older releases do — the table below lists all 2.

Package health score 76/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Niche
  • Community Quiet

What to do: Stay on v2.16.2 or newer. This can change: a vulnerability disclosed tomorrow can affect v2.16.2 too — Vulert watches the package and alerts you if that happens. Monitor it with Vulert →

  • Current release v2.16.2 — unaffected i
  • Vulnerabilities on record 2 over 1 year · 0 in the last year i
  • Latest disclosure 29 Jan 2025 i
  • Highest CVSS 5.9 i
  • With no published fix 0 i
  • Stars 447 i
  • OpenSSF scorecard 4/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/compose-spec/compose-go/v2, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v2.16.2 21 Oct 2026 none Apache-2.0 — Details →
v2.16.2-0.20261015044941-5515644a24af 15 Oct 2026 none Apache-2.0 — Details →
v2.16.2-0.20261012152039-c53b35077dd1 12 Oct 2026 none Apache-2.0 — Details →
v2.16.1 29 Sep 2026 none Apache-2.0 — Details →
v2.16.0 29 Sep 2026 none Apache-2.0 — Details →
v2.15.1-0.20260918184426-f18e211cbeaf 18 Sep 2026 none Apache-2.0 — Details →
v2.15.1-0.20260918071313-4d56f8175625 18 Sep 2026 none Apache-2.0 — Details →
v2.15.1-0.20260916114207-9047519086ed 16 Sep 2026 none Apache-2.0 — Details →
v2.15.1-0.20260910154416-11feead015fc 10 Sep 2026 none Apache-2.0 — Details →
v2.15.1-0.20260910130034-0e17c6437ebb 10 Sep 2026 none Apache-2.0 — Details →
v2.15.1-0.20260908103050-cda18529aca7 08 Sep 2026 none Apache-2.0 — Details →
v2.14.1-0.20260903083236-4ddbf11f8bd3 03 Sep 2026 none Apache-2.0 — Details →
v2.15.0 03 Sep 2026 none Apache-2.0 — Details →
v2.14.1-0.20260831152353-f0442ffced5b 31 Aug 2026 none Apache-2.0 — Details →
v2.14.1-0.20260827102033-ffc514aa427d 27 Aug 2026 none Apache-2.0 — Details →
v2.14.1-0.20260825154407-6c1c2d727681 25 Aug 2026 none Apache-2.0 — Details →
v2.14.1-0.20260818064232-01ef19011c7e 18 Aug 2026 none Apache-2.0 — Details →
v2.14.1-0.20260812094732-5ebe0d730b11 12 Aug 2026 none Apache-2.0 — Details →
v2.14.1-0.20260811155634-97e56ed1a904 11 Aug 2026 none Apache-2.0 — Details →
v2.14.1-0.20260803075252-778429d5dba2 03 Aug 2026 none Apache-2.0 — Details →
v2.14.0 30 Jul 2026 none Apache-2.0 — Details →
v2.13.1-0.20260729133502-b3992fc4004d 29 Jul 2026 none Apache-2.0 — Details →
v2.13.1-0.20260721083329-e70e961c3a3a 21 Jul 2026 none Apache-2.0 — Details →
v2.13.1-0.20260720102902-5a265f53e397 20 Jul 2026 none Apache-2.0 — Details →
v2.13.1-0.20260706074530-f37e1e0eeebf 06 Jul 2026 none Apache-2.0 — Details →
v2.13.0 29 Jun 2026 none Apache-2.0 — Details →
v2.12.0 22 Jun 2026 none Apache-2.0 — Details →
v2.12.1 22 Jun 2026 none Apache-2.0 — Details →
v2.11.1-0.20260601134807-d48021c526f3 01 Jun 2026 none Apache-2.0 — Details →
v2.11.1-0.20260601065432-9f1afcc46e8b 01 Jun 2026 none Apache-2.0 — Details →
v2.11.1-0.20260527092436-9b9620a083cd 27 May 2026 none Apache-2.0 — Details →
v2.11.0 20 May 2026 none Apache-2.0 — Details →
v2.10.3-0.20260417122745-f8882ec09ce8 17 Apr 2026 none Apache-2.0 — Details →
v2.10.2-0.20260401065711-65af4e5d5e44 01 Apr 2026 none Apache-2.0 — Details →
v2.10.2 30 Mar 2026 none Apache-2.0 — Details →
v2.10.2-0.20260330074203-d8a259c25306 30 Mar 2026 none Apache-2.0 — Details →
v2.10.2-0.20260325085325-a5376f96ee36 25 Mar 2026 none Apache-2.0 — Details →
v2.10.2-0.20260325085325-b9f4c49307d8 25 Mar 2026 none Apache-2.0 — Details →
v2.10.2-0.20260324133015-9e540fdc6b00 24 Mar 2026 none Apache-2.0 — Details →
v2.10.2-0.20260319093721-df29b8a6c1a9 19 Mar 2026 none Apache-2.0 — Details →
v2.10.2-0.20260129130100-9dee8f4f1a35 29 Jan 2026 none Apache-2.0 — Details →
v2.10.1 16 Jan 2026 none Apache-2.0 — Details →
v2.10.1-0.20260116073713-ddb94f10f3a0 16 Jan 2026 none Apache-2.0 — Details →
v2.10.1-0.20260112130854-8c75dbf7f75b 12 Jan 2026 none Apache-2.0 — Details →
v2.10.1-0.20251215081411-bb50e25966ed 15 Dec 2025 none Apache-2.0 — Details →
v2.10.1-0.20251215071623-029d7ac5f460 15 Dec 2025 none Apache-2.0 — Details →
v2.10.0 25 Nov 2025 none Apache-2.0 — Details →
v2.9.2-0.20251125161506-3d3411d9d856 25 Nov 2025 none Apache-2.0 — Details →
v2.9.2-0.20251125103817-dbfe61974b3f 25 Nov 2025 none Apache-2.0 — Details →
v2.9.2-0.20251112133323-61f9ceae27da 12 Nov 2025 none Apache-2.0 — Details →
v2.9.2-0.20251110162437-dabd353441f5 10 Nov 2025 none Apache-2.0 — Details →
v2.9.2-0.20251105175655-1b2139eefd8a 05 Nov 2025 none Apache-2.0 — Details →
v2.9.1 30 Oct 2025 none Apache-2.0 — Details →
v2.9.1-0.20251028114912-abb36f7aed26 28 Oct 2025 none Apache-2.0 — Details →
v2.9.1-0.20251028085147-45305bfca8aa 28 Oct 2025 none Apache-2.0 — Details →
v2.9.1-0.20251028084549-a91b45ce9b66 28 Oct 2025 none Apache-2.0 — Details →
v2.8.3-0.20250917164343-9a11fcb1e362 17 Sep 2025 none Apache-2.0 — Details →
v2.9.0 17 Sep 2025 none Apache-2.0 — Details →
v2.8.2 08 Sep 2025 none Apache-2.0 — Details →
v2.8.2-0.20250902071938-e16f794feedd 02 Sep 2025 none Apache-2.0 — Details →
v2.8.2-0.20250811074412-c2a30d7a79cb 11 Aug 2025 none Apache-2.0 — Details →
v2.8.1 24 Jul 2025 none Apache-2.0 — Details →
v2.8.1-0.20250724131002-0bd910723fa2 24 Jul 2025 none Apache-2.0 — Details →
v2.8.0 23 Jul 2025 none Apache-2.0 — Details →
v2.7.2-0.20250723090036-aa1ee1a5a3f9 23 Jul 2025 none Apache-2.0 — Details →
v2.7.2-0.20250721082312-a42e7579d813 21 Jul 2025 none Apache-2.0 — Details →
v2.7.2-0.20250719071440-a2b696921405 19 Jul 2025 none Apache-2.0 — Details →
v2.7.2-0.20250715094302-8da9902241f9 15 Jul 2025 none Apache-2.0 — Details →
v2.7.2-0.20250715054920-924bff96ef98 15 Jul 2025 none Apache-2.0 — Details →
v2.7.2-0.20250703132301-891fce532a51 03 Jul 2025 none Apache-2.0 — Details →
v2.7.2-0.20250702202822-6dc952d32898 02 Jul 2025 none Apache-2.0 — Details →
v2.7.1 30 Jun 2025 none Apache-2.0 — Details →
v2.7.0 30 Jun 2025 none Apache-2.0 — Details →
v2.6.5 20 Jun 2025 none Apache-2.0 — Details →
v2.0.0-20250605125952-a0d3b94b8dc9 05 Jun 2025 none Apache-2.0 — Details →
v2.6.5-0.20250605125952-a0d3b94b8dc9 05 Jun 2025 none Apache-2.0 — Details →
v2.6.5-0.20250603065854-879242652fa0 03 Jun 2025 none Apache-2.0 — Details →
v2.6.4 20 May 2025 none Apache-2.0 — Details →
v2.6.4-0.20250520120551-a6c896cdf0d9 20 May 2025 none Apache-2.0 — Details →
v2.6.3 19 May 2025 none Apache-2.0 — Details →
v2.6.3-0.20250514071718-e0a023201dac 14 May 2025 none Apache-2.0 — Details →
v2.6.3-0.20250512080201-8a6ac958ac81 12 May 2025 none Apache-2.0 — Details →
v2.6.2 07 May 2025 none Apache-2.0 — Details →
v2.6.2-0.20250506145510-9fb79a6b980c 06 May 2025 none Apache-2.0 — Details →
v2.6.2-0.20250505073753-24f8e906e60c 05 May 2025 none Apache-2.0 — Details →
v2.6.2-0.20250428083459-6f5d91489978 28 Apr 2025 none Apache-2.0 — Details →
v2.6.2-0.20250428082045-7eb3472a5a95 28 Apr 2025 none Apache-2.0 — Details →
v2.6.2-0.20250427142012-c2eed30927ec 27 Apr 2025 none Apache-2.0 — Details →
v2.6.2-0.20250425075447-ca961cc58145 25 Apr 2025 none Apache-2.0 — Details →
v2.6.2-0.20250425063133-0879548593a1 25 Apr 2025 none Apache-2.0 — Details →
v2.6.2-0.20250423150733-5f4c99eef87a 23 Apr 2025 none Apache-2.0 — Details →
v2.6.2-0.20250423090706-30ff01d36f76 23 Apr 2025 none Apache-2.0 — Details →
v2.6.1 22 Apr 2025 none Apache-2.0 — Details →
v2.6.0 10 Apr 2025 none Apache-2.0 — Details →
v2.5.1-0.20250409144709-bcdb61af2585 09 Apr 2025 none Apache-2.0 — Details →
v2.5.1-0.20250409073204-583d2e14623e 09 Apr 2025 none Apache-2.0 — Details →
v2.5.1-0.20250409070949-8e1a035095ca 09 Apr 2025 none Apache-2.0 — Details →
v2.5.1-0.20250409070039-4ac1f5e88805 09 Apr 2025 none Apache-2.0 — Details →
v2.5.1-0.20250408074005-7058bce1b39e 08 Apr 2025 none Apache-2.0 — Details →
v2.5.0 02 Apr 2025 none Apache-2.0 — Details →
v2.4.10-0.20250401090006-e705dd3bb56f 01 Apr 2025 none — — Details →
v2.4.10-0.20250331134233-b35ee99d76eb 31 Mar 2025 none — — Details →
v2.4.10-0.20250331072428-83fc0041ae66 31 Mar 2025 none — — Details →
v2.4.9-0.20250331072428-83fc0041ae66 31 Mar 2025 none — — Details →
v2.4.10-0.20250328131503-d2c9f1e85429 28 Mar 2025 none — — Details →
v2.4.9-0.20250328131503-d2c9f1e85429 28 Mar 2025 none — — Details →
v2.4.10-0.20250327151131-f48efd965e24 27 Mar 2025 none — — Details →
v2.4.10-0.20250325145405-c7613e29837f 25 Mar 2025 none — — Details →
v2.4.10-0.20250319144024-b5e4cda6bca6 19 Mar 2025 none — — Details →
v2.4.10-0.20250319130939-f2c798104df6 19 Mar 2025 none — — Details →
v2.4.9-0.20250319130939-f2c798104df6 19 Mar 2025 none — — Details →
v2.4.10-0.20250319114556-312596f4c1fe 19 Mar 2025 none — — Details →
v2.4.10-0.20250319112509-6e26888dc548 19 Mar 2025 none — — Details →
v2.4.10-0.20250319111647-962ded5d7796 19 Mar 2025 none — — Details →
v2.4.9 13 Mar 2025 none — — Details →
v2.4.9-0.20250313142844-e34507916d23 13 Mar 2025 none — — Details →
v2.4.9-0.20250311092138-842b06cefbdd 11 Mar 2025 none — — Details →
v2.4.9-0.20250310085957-2955d4e58095 10 Mar 2025 none — — Details →
v2.4.9-0.20250307154133-53320326687c 07 Mar 2025 none — — Details →
v2.4.9-0.20250306145913-fe089b54fd40 06 Mar 2025 none — — Details →

The newest 120 of 314 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2025 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 2 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/compose-spec/compose-go/v2

The 2 most severe of 2 vulnerabilities recorded for this package

Search all 2 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2024-10846: Excessive Resource Consumption in compose-go Package Due to Malicious YAML Payloads 5.9 medium 2.4.1 21 Jan 2025
CVE-2024-10846: Excessive Resource Consumption in github.com/compose-spec/compose-go/v2 N/A unrated 2.4.1 29 Jan 2025

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/compose-spec/compose-go/v2

Is github.com/compose-spec/compose-go/v2 safe to use?

Vulert records 2 vulnerabilities for github.com/compose-spec/compose-go/v2 in Go: 0 critical, 0 high, 1 medium and 0 low, plus 1 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/compose-spec/compose-go/v2's Vulert package health score?

Vulert scores github.com/compose-spec/compose-go/v2 76/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/compose-spec/compose-go/v2 affected?

No. v2.16.2, the version you would install today, has no vulnerabilities on record against it. Earlier releases do — the version table above lists each release with what affects it.

How many vulnerabilities does github.com/compose-spec/compose-go/v2 have?

2 vulnerabilities are recorded for github.com/compose-spec/compose-go/v2 in the Go ecosystem: 0 critical, 0 high, 1 medium and 0 low, plus 1 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/compose-spec/compose-go/v2 vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/compose-spec/compose-go/v2 in the last 12 months, and the oldest entry in this database dates to 21 Jan 2025. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/compose-spec/compose-go/v2 are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/compose-spec/compose-go/v2 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/compose-spec/compose-go/v2 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.