Refine your search
3 vulnerabilities found for by knative
CVE-2026-54462 (GCVE-0-2026-54462)
Vulnerability from cvelistv5
Published
2026-10-27 16:12
Modified
2026-10-27 16:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Summary
Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoder(io.TeeReader(r.Body, &bodyBuffer)) under an http.HandlerFunc without an http.MaxBytesReader or equivalent body-size limit. A pod-network client can send one oversized POST to an admission webhook, causing the decoder and bodyBuffer to retain amplified copies of the request until the controller pod exhausts memory and is OOM-killed. Every downstream consumer using the shared webhook server inherits the vulnerable behavior, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. For consumers configured with failurePolicy=Fail, loss of the controller can interrupt admission; with failurePolicy=Ignore, the affected webhook is unavailable while other admissions continue. This issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "pkg",
"vendor": "knative",
"versions": [
{
"status": "affected",
"version": "\u003c 0.0.0-20260531000007-52dbd5ece63f"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoder(io.TeeReader(r.Body, \u0026bodyBuffer)) under an http.HandlerFunc without an http.MaxBytesReader or equivalent body-size limit. A pod-network client can send one oversized POST to an admission webhook, causing the decoder and bodyBuffer to retain amplified copies of the request until the controller pod exhausts memory and is OOM-killed. Every downstream consumer using the shared webhook server inherits the vulnerable behavior, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. For consumers configured with failurePolicy=Fail, loss of the controller can interrupt admission; with failurePolicy=Ignore, the affected webhook is unavailable while other admissions continue. This issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T16:12:32.516Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/knative/pkg/security/advisories/GHSA-2hw4-c9m4-f2fj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/knative/pkg/security/advisories/GHSA-2hw4-c9m4-f2fj"
},
{
"name": "https://github.com/knative/pkg/pull/3363",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/knative/pkg/pull/3363"
},
{
"name": "https://github.com/knative/pkg/commit/52dbd5ece63fe6d2d340ecbebec160550f460818",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/knative/pkg/commit/52dbd5ece63fe6d2d340ecbebec160550f460818"
}
],
"source": {
"advisory": "GHSA-2hw4-c9m4-f2fj",
"discovery": "UNKNOWN"
},
"title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54462",
"datePublished": "2026-10-27T16:12:32.516Z",
"dateReserved": "2026-06-15T15:30:40.318Z",
"dateUpdated": "2026-10-27T16:12:32.516Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-48713 (GCVE-0-2023-48713)
Vulnerability from cvelistv5
Published
2023-11-28 03:44
Modified
2024-10-11 17:58
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-400 - Uncontrolled Resource Consumption
Summary
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound memory allocation bug. This is a DoS vulnerability, where a non-privileged Knative user can cause a DoS for the cluster. This issue has been patched in version 0.39.0.
References
| URL | Tags | |
|---|---|---|
|
|
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:37:54.657Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/knative/serving/security/advisories/GHSA-qmvj-4qr9-v547",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/knative/serving/security/advisories/GHSA-qmvj-4qr9-v547"
},
{
"name": "https://github.com/knative/serving/commit/012ee2509231b80b7842139bfabc30516d3026ca",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/knative/serving/commit/012ee2509231b80b7842139bfabc30516d3026ca"
},
{
"name": "https://github.com/knative/serving/commit/101f814112b9ca0767f457e7e616b46205551cf1",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/knative/serving/commit/101f814112b9ca0767f457e7e616b46205551cf1"
},
{
"name": "https://github.com/knative/serving/commit/fff40ef7bac9be8380ec3d1c70fc15b57093382a",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/knative/serving/commit/fff40ef7bac9be8380ec3d1c70fc15b57093382a"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-48713",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-11T17:51:35.195449Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-11T17:58:05.682Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "serving",
"vendor": "knative",
"versions": [
{
"status": "affected",
"version": "\u003c 0.39.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound memory allocation bug. This is a DoS vulnerability, where a non-privileged Knative user can cause a DoS for the cluster. This issue has been patched in version 0.39.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-28T03:44:59.538Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/knative/serving/security/advisories/GHSA-qmvj-4qr9-v547",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/knative/serving/security/advisories/GHSA-qmvj-4qr9-v547"
},
{
"name": "https://github.com/knative/serving/commit/012ee2509231b80b7842139bfabc30516d3026ca",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/knative/serving/commit/012ee2509231b80b7842139bfabc30516d3026ca"
},
{
"name": "https://github.com/knative/serving/commit/101f814112b9ca0767f457e7e616b46205551cf1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/knative/serving/commit/101f814112b9ca0767f457e7e616b46205551cf1"
},
{
"name": "https://github.com/knative/serving/commit/fff40ef7bac9be8380ec3d1c70fc15b57093382a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/knative/serving/commit/fff40ef7bac9be8380ec3d1c70fc15b57093382a"
}
],
"source": {
"advisory": "GHSA-qmvj-4qr9-v547",
"discovery": "UNKNOWN"
},
"title": "Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-48713",
"datePublished": "2023-11-28T03:44:59.538Z",
"dateReserved": "2023-11-17T19:43:37.555Z",
"dateUpdated": "2024-10-11T17:58:05.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-41939 (GCVE-0-2022-41939)
Vulnerability from cvelistv5
Published
2022-11-19 00:00
Modified
2025-04-22 16:02
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Summary
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious `lifecycle` container. This issues has been patched in PR #1442, and is part of release 1.8.1. This issue only affects users who are using function buildpacks from third-parties; pinning the builder image to a specific content-hash with a valid `lifecycle` image will also mitigate the attack.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:56:38.664Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/knative/func/security/advisories/GHSA-5336-2g3f-9g3m"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/knative/func/pull/1442"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/knative/func/blob/5ca77d38744d3481cc0b795f607c5859b19588fc/buildpacks/builder.go#L37-L41"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/knative/func/releases/tag/knative-v1.8.1"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41939",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-22T15:41:32.476298Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-22T16:02:39.059Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "func",
"vendor": "knative",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious `lifecycle` container. This issues has been patched in PR #1442, and is part of release 1.8.1. This issue only affects users who are using function buildpacks from third-parties; pinning the builder image to a specific content-hash with a valid `lifecycle` image will also mitigate the attack."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-19T00:00:00.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://github.com/knative/func/security/advisories/GHSA-5336-2g3f-9g3m"
},
{
"url": "https://github.com/knative/func/pull/1442"
},
{
"url": "https://github.com/knative/func/blob/5ca77d38744d3481cc0b795f607c5859b19588fc/buildpacks/builder.go#L37-L41"
},
{
"url": "https://github.com/knative/func/releases/tag/knative-v1.8.1"
}
],
"source": {
"advisory": "GHSA-5336-2g3f-9g3m",
"discovery": "UNKNOWN"
},
"title": "Credential exposure when running third-party builders in knative/func"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-41939",
"datePublished": "2022-11-19T00:00:00.000Z",
"dateReserved": "2022-09-30T00:00:00.000Z",
"dateUpdated": "2025-04-22T16:02:39.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}