Vulnerability-Lookup

GHSA-8FMV-6RG5-5924

Vulnerability from github – Published: 2026-10-30 23:13 – Updated: 2026-10-30 23:13

Summary

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Details

Summary

The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file, potentially exhausting API-server resources and interrupting service.

Multipart pipeline and pipeline-version upload processing decompresses the archive before namespace authorization, so a caller who can reach those endpoints does not need a successful pipeline-create authorization decision to trigger the issue. External authentication and network controls can restrict reachability. URL-import handlers authorize before fetching and decompressing a remote archive.

The amount of expansion needed to exhaust memory depends on deployment resource limits and concurrent activity; no particular archive is guaranteed to crash every deployment.

Remediation

Upgrade the API server to Kubeflow Pipelines 2.18.0. Versions through 2.17.3 are affected; the first affected release has not been established.

PR #14171 bounds compressed input and extracted pipeline data. PR #14186 strengthens the total tar traversal budget, including metadata and skipped entries. The 2.18 release also includes configurable upload and specification limits; operators should review the shipped settings and resource budget. These controls address pipeline archive amplification and do not establish general HTTP-body, temporary-disk, concurrency, or CPU limits.

Until upgrading, restrict access to upload and import endpoints and apply deployment-level request and resource controls. A compressed upload-size limit alone does not prevent decompression amplification. Regression tests cover compressed input, selected-entry boundaries, and tar traversal budgets; no deployed-server OOM test was performed for this assessment.

Credit

bugbunny.ai discovered and reported the issue. Ayush Gupta (@Ayush-kathil) authored the archive fixes in #14171 and #14186, with Jeff Spahr (@jeffspahr) contributing regression coverage to #14171.

@BrianWillows later submitted a mixed report that included source analysis of pipeline-archive decompression.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kubeflow/pipelines"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260831164314-ba9ae72cc860"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kubeflow/pipelines"
      },
      "versions": [
        "1.7.0-alpha.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-118761"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-409"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-30T23:13:38Z",
    "nvd_published_at": "2026-10-29T17:18:06Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file, potentially exhausting API-server resources and interrupting service.\n\nMultipart pipeline and pipeline-version upload processing decompresses the archive before namespace authorization, so a caller who can reach those endpoints does not need a successful pipeline-create authorization decision to trigger the issue. External authentication and network controls can restrict reachability. URL-import handlers authorize before fetching and decompressing a remote archive.\n\nThe amount of expansion needed to exhaust memory depends on deployment resource limits and concurrent activity; no particular archive is guaranteed to crash every deployment.\n\n## Remediation\n\nUpgrade the API server to **[Kubeflow Pipelines 2.18.0](https://github.com/kubeflow/pipelines/releases/tag/2.18.0)**. Versions through 2.17.3 are affected; the first affected release has not been established.\n\n[PR #14171](https://github.com/kubeflow/pipelines/pull/14171) bounds compressed input and extracted pipeline data. [PR #14186](https://github.com/kubeflow/pipelines/pull/14186) strengthens the total tar traversal budget, including metadata and skipped entries. The 2.18 release also includes configurable upload and specification limits; operators should review the shipped settings and resource budget. These controls address pipeline archive amplification and do not establish general HTTP-body, temporary-disk, concurrency, or CPU limits.\n\nUntil upgrading, restrict access to upload and import endpoints and apply deployment-level request and resource controls. A compressed upload-size limit alone does not prevent decompression amplification. Regression tests cover compressed input, selected-entry boundaries, and tar traversal budgets; no deployed-server OOM test was performed for this assessment.\n\n## Credit\n\n[bugbunny.ai](https://bugbunny.ai) discovered and reported the issue. Ayush Gupta ([@Ayush-kathil](https://github.com/Ayush-kathil)) authored the archive fixes in #14171 and #14186, with Jeff Spahr ([@jeffspahr](https://github.com/jeffspahr)) contributing regression coverage to #14171.\n\n[@BrianWillows](https://github.com/BrianWillows) later submitted a mixed report that included source analysis of pipeline-archive decompression.",
  "id": "GHSA-8fmv-6rg5-5924",
  "modified": "2026-10-30T23:13:39Z",
  "published": "2026-10-30T23:13:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118761"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeflow/pipelines/pull/14171"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeflow/pipelines/pull/14186"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kubeflow/pipelines"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory"
}

CVE-2026-118761 (GCVE-0-2026-118761)

Vulnerability from cvelistv5 – Published: 2026-10-29 16:37 – Updated: 2026-10-29 20:18

Title

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Summary

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 20:18 UTC

CWE

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8129 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/kubeflow/pipelines/security/ad…	x_refsource_CONFIRM
https://github.com/kubeflow/pipelines/pull/14171	x_refsource_MISC
https://github.com/kubeflow/pipelines/pull/14186	x_refsource_MISC
https://github.com/kubeflow/pipelines/commit/1121…	x_refsource_MISC
https://github.com/kubeflow/pipelines/commit/ba9a…	x_refsource_MISC
https://github.com/kubeflow/pipelines/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kubeflow	pipelines	Affected: < 2.18.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118761",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T20:18:49.737846Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T20:18:59.625Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pipelines",
          "vendor": "kubeflow",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.18.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T16:37:44.333Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924"
        },
        {
          "name": "https://github.com/kubeflow/pipelines/pull/14171",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeflow/pipelines/pull/14171"
        },
        {
          "name": "https://github.com/kubeflow/pipelines/pull/14186",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeflow/pipelines/pull/14186"
        },
        {
          "name": "https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953"
        },
        {
          "name": "https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5"
        },
        {
          "name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
        }
      ],
      "source": {
        "advisory": "GHSA-8fmv-6rg5-5924",
        "discovery": "UNKNOWN"
      },
      "title": "Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118761",
    "datePublished": "2026-10-29T16:37:44.333Z",
    "dateReserved": "2026-10-28T19:20:05.017Z",
    "dateUpdated": "2026-10-29T20:18:59.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-8FMV-6RG5-5924

Summary

Remediation

Credit

CVE-2026-118761 (GCVE-0-2026-118761)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour