Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner

Sources

Sort by

Order

Apply ordering (override relevance)

CVE-2026-44247 (GCVE-0-2026-44247)

Vulnerability from cvelistv5 – Published: 2026-05-27 20:56 – Updated: 2026-05-30 01:50

Title

Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body size

Summary

Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook server exposed to in-cluster traffic are affected. This vulnerability is fixed in v1.14.2, v1.13.3, and v1.12.4.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/volcano-sh/volcano/security/ad…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
volcano-sh	volcano	Affected: >= 1.14.0-alpha.0, < 1.14.2 Affected: >= 1.13.0, < 1.13.3 Affected: < 1.12.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44247",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-30T01:50:29.251207Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-30T01:50:43.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "volcano",
          "vendor": "volcano-sh",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.14.0-alpha.0, \u003c 1.14.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.13.3"
            },
            {
              "status": "affected",
              "version": "\u003c 1.12.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook server exposed to in-cluster traffic are affected. This vulnerability is fixed in v1.14.2, v1.13.3, and v1.12.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T20:56:47.220Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/volcano-sh/volcano/security/advisories/GHSA-8wxp-xxp2-rcgx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/volcano-sh/volcano/security/advisories/GHSA-8wxp-xxp2-rcgx"
        }
      ],
      "source": {
        "advisory": "GHSA-8wxp-xxp2-rcgx",
        "discovery": "UNKNOWN"
      },
      "title": "Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body size"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44247",
    "datePublished": "2026-05-27T20:56:47.220Z",
    "dateReserved": "2026-05-05T16:33:55.844Z",
    "dateUpdated": "2026-05-30T01:50:43.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-32777 (GCVE-0-2025-32777)

Vulnerability from cvelistv5 – Published: 2025-04-30 18:27 – Updated: 2025-05-01 18:51

Title

Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin

Summary

Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacker compromise of either the Elastic service or the extender plugin can cause denial of service of the scheduler. This is a privilege escalation, because Volcano users may run their Elastic service and extender plugins in separate pods or nodes from the scheduler. In the Kubernetes security model, node isolation is a security boundary, and as such an attacker is able to cross that boundary in Volcano's case if they have compromised either the vulnerable services or the pod/node in which they are deployed. The scheduler will become unavailable to other users and workloads in the cluster. The scheduler will either crash with an unrecoverable OOM panic or freeze while consuming excessive amounts of memory. This issue has been patched in versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

6 references

URL	Tags
https://github.com/volcano-sh/volcano/security/ad…	x_refsource_CONFIRM
https://github.com/volcano-sh/volcano/releases/ta…	x_refsource_MISC
https://github.com/volcano-sh/volcano/releases/ta…	x_refsource_MISC
https://github.com/volcano-sh/volcano/releases/ta…	x_refsource_MISC
https://github.com/volcano-sh/volcano/releases/ta…	x_refsource_MISC
https://github.com/volcano-sh/volcano/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
volcano-sh	volcano	Affected: >= 1.11.0, < 1.11.2 Affected: >= 1.10.0-alpha.0, < 1.10.2 Affected: < 1.9.1 Affected: >= 1.11.0-network-topology-preview.0, < 1.11.0-network-topology-preview.3 Affected: >= 1.12.0-alpha.0, < 1.12.0-alpha.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-32777",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-01T18:51:25.416268Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-01T18:51:41.932Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "volcano",
          "vendor": "volcano-sh",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.11.0, \u003c 1.11.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.10.0-alpha.0, \u003c 1.10.2"
            },
            {
              "status": "affected",
              "version": "\u003c 1.9.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.11.0-network-topology-preview.0, \u003c 1.11.0-network-topology-preview.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.12.0-alpha.0, \u003c 1.12.0-alpha.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacker compromise of either the Elastic service or the extender plugin can cause denial of service of the scheduler. This is a privilege escalation, because Volcano users may run their Elastic service and extender plugins in separate pods or nodes from the scheduler. In the Kubernetes security model, node isolation is a security boundary, and as such an attacker is able to cross that boundary in Volcano\u0027s case if they have compromised either the vulnerable services or the pod/node in which they are deployed. The scheduler will become unavailable to other users and workloads in the cluster. The scheduler will either crash with an unrecoverable OOM panic or freeze while consuming excessive amounts of memory. This issue has been patched in versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T18:27:16.929Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/volcano-sh/volcano/security/advisories/GHSA-hg79-fw4p-25p8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/volcano-sh/volcano/security/advisories/GHSA-hg79-fw4p-25p8"
        },
        {
          "name": "https://github.com/volcano-sh/volcano/releases/tag/v1.10.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/volcano-sh/volcano/releases/tag/v1.10.2"
        },
        {
          "name": "https://github.com/volcano-sh/volcano/releases/tag/v1.11.0-network-topology-preview.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/volcano-sh/volcano/releases/tag/v1.11.0-network-topology-preview.3"
        },
        {
          "name": "https://github.com/volcano-sh/volcano/releases/tag/v1.11.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/volcano-sh/volcano/releases/tag/v1.11.2"
        },
        {
          "name": "https://github.com/volcano-sh/volcano/releases/tag/v1.12.0-alpha.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/volcano-sh/volcano/releases/tag/v1.12.0-alpha.2"
        },
        {
          "name": "https://github.com/volcano-sh/volcano/releases/tag/v1.9.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/volcano-sh/volcano/releases/tag/v1.9.1"
        }
      ],
      "source": {
        "advisory": "GHSA-hg79-fw4p-25p8",
        "discovery": "UNKNOWN"
      },
      "title": "Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-32777",
    "datePublished": "2025-04-30T18:27:16.929Z",
    "dateReserved": "2025-04-10T12:51:12.278Z",
    "dateUpdated": "2025-05-01T18:51:41.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

2 vulnerabilities by volcano-sh

CVE-2026-44247 (GCVE-0-2026-44247)

CVE-2025-32777 (GCVE-0-2025-32777)