Search
Find a vulnerability
Search criteria
2 vulnerabilities found for pkg by knative
CVE-2026-54462 (GCVE-0-2026-54462)
Vulnerability from nvd – Published: 2026-10-27 16:12 – Updated: 2026-10-27 16:12
VLAI
EPSS
VEX
Title
knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion
Summary
Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoder(io.TeeReader(r.Body, &bodyBuffer)) under an http.HandlerFunc without an http.MaxBytesReader or equivalent body-size limit. A pod-network client can send one oversized POST to an admission webhook, causing the decoder and bodyBuffer to retain amplified copies of the request until the controller pod exhausts memory and is OOM-killed. Every downstream consumer using the shared webhook server inherits the vulnerable behavior, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. For consumers configured with failurePolicy=Fail, loss of the controller can interrupt admission; with failurePolicy=Ignore, the affected webhook is unavailable while other admissions continue. This issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f.
Severity
6.5 (Medium)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/knative/pkg/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/knative/pkg/pull/3363 | x_refsource_MISC |
| https://github.com/knative/pkg/commit/52dbd5ece63… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "pkg",
"vendor": "knative",
"versions": [
{
"status": "affected",
"version": "\u003c 0.0.0-20260531000007-52dbd5ece63f"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoder(io.TeeReader(r.Body, \u0026bodyBuffer)) under an http.HandlerFunc without an http.MaxBytesReader or equivalent body-size limit. A pod-network client can send one oversized POST to an admission webhook, causing the decoder and bodyBuffer to retain amplified copies of the request until the controller pod exhausts memory and is OOM-killed. Every downstream consumer using the shared webhook server inherits the vulnerable behavior, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. For consumers configured with failurePolicy=Fail, loss of the controller can interrupt admission; with failurePolicy=Ignore, the affected webhook is unavailable while other admissions continue. This issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T16:12:32.516Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/knative/pkg/security/advisories/GHSA-2hw4-c9m4-f2fj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/knative/pkg/security/advisories/GHSA-2hw4-c9m4-f2fj"
},
{
"name": "https://github.com/knative/pkg/pull/3363",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/knative/pkg/pull/3363"
},
{
"name": "https://github.com/knative/pkg/commit/52dbd5ece63fe6d2d340ecbebec160550f460818",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/knative/pkg/commit/52dbd5ece63fe6d2d340ecbebec160550f460818"
}
],
"source": {
"advisory": "GHSA-2hw4-c9m4-f2fj",
"discovery": "UNKNOWN"
},
"title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54462",
"datePublished": "2026-10-27T16:12:32.516Z",
"dateReserved": "2026-06-15T15:30:40.318Z",
"dateUpdated": "2026-10-27T16:12:32.516Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54462 (GCVE-0-2026-54462)
Vulnerability from cvelistv5 – Published: 2026-10-27 16:12 – Updated: 2026-10-27 16:12
VLAI
EPSS
VEX
Title
knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion
Summary
Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoder(io.TeeReader(r.Body, &bodyBuffer)) under an http.HandlerFunc without an http.MaxBytesReader or equivalent body-size limit. A pod-network client can send one oversized POST to an admission webhook, causing the decoder and bodyBuffer to retain amplified copies of the request until the controller pod exhausts memory and is OOM-killed. Every downstream consumer using the shared webhook server inherits the vulnerable behavior, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. For consumers configured with failurePolicy=Fail, loss of the controller can interrupt admission; with failurePolicy=Ignore, the affected webhook is unavailable while other admissions continue. This issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f.
Severity
6.5 (Medium)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/knative/pkg/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/knative/pkg/pull/3363 | x_refsource_MISC |
| https://github.com/knative/pkg/commit/52dbd5ece63… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "pkg",
"vendor": "knative",
"versions": [
{
"status": "affected",
"version": "\u003c 0.0.0-20260531000007-52dbd5ece63f"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoder(io.TeeReader(r.Body, \u0026bodyBuffer)) under an http.HandlerFunc without an http.MaxBytesReader or equivalent body-size limit. A pod-network client can send one oversized POST to an admission webhook, causing the decoder and bodyBuffer to retain amplified copies of the request until the controller pod exhausts memory and is OOM-killed. Every downstream consumer using the shared webhook server inherits the vulnerable behavior, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. For consumers configured with failurePolicy=Fail, loss of the controller can interrupt admission; with failurePolicy=Ignore, the affected webhook is unavailable while other admissions continue. This issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T16:12:32.516Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/knative/pkg/security/advisories/GHSA-2hw4-c9m4-f2fj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/knative/pkg/security/advisories/GHSA-2hw4-c9m4-f2fj"
},
{
"name": "https://github.com/knative/pkg/pull/3363",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/knative/pkg/pull/3363"
},
{
"name": "https://github.com/knative/pkg/commit/52dbd5ece63fe6d2d340ecbebec160550f460818",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/knative/pkg/commit/52dbd5ece63fe6d2d340ecbebec160550f460818"
}
],
"source": {
"advisory": "GHSA-2hw4-c9m4-f2fj",
"discovery": "UNKNOWN"
},
"title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54462",
"datePublished": "2026-10-27T16:12:32.516Z",
"dateReserved": "2026-06-15T15:30:40.318Z",
"dateUpdated": "2026-10-27T16:12:32.516Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}