GHSA-6f2p-2qg2-qqch

    Dashboard / Vulnerabilities / GHSA-6f2p-2qg2-qqch

    GHSA-6f2p-2qg2-qqch

    Published: 26 Jun 2026Last Modified: 5 Nov 2026

    Summary: KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption

    Details: A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.

    References: https://nvd.nist.gov/vuln/detail/CVE-2026-13322, https://access.redhat.com/security/cve/CVE-2026-13322, https://bugzilla.redhat.com/show_bug.cgi?id=2492681, https://github.com/kubevirt/kubevirt, https://github.com/kubevirt/kubevirt/blob/e63503d2f3a166f79f0891f8e1c3450eb39f88ac/pkg/downwardmetrics/virtio-serial/server.go#L240-L251

    Affected packages

    Package

    Name: github.com/kubevirt/kubevirt

    Purl: pkg:golang/github.com/kubevirt/kubevirt

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 1.1.0-alpha.0
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-6f2p-2qg2-qqch | CVE-DB