EUVD-2026-84004
GHSA-gfw4-49f9-cp25
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise or enroll an authenticated edge peer
-
DeliveryCraft header with excessive PayloadLen
-
ExploitCloudHub allocates memory pre-validation
-
ExecutionRepeat to exhaust host memory
-
PersistCloudHub crash or restart loop
-
ImpactCloud-edge communication disrupted
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | Requires an authenticated edge peer with an established viaduct connection to CloudHub - i.e., a valid enrolled edge node or one whose credentials/certificate have been compromised (PR:L). The attacker sends crafted PackageHeader frames with an inflated 32-bit PayloadLen over the CloudHub viaduct message-processing path (pkg/viaduct/pkg/packer). Affected versions are 1.0.0 up to but not including 1.21.2, 1.22.2, and 1.23.1. Limiting factors: no unauthenticated exploitation, no user interaction, and impact is confined to availability (CloudHub termination / restart loops / temporary cloud-edge disruption) - there is no confidentiality or integrity loss and no code execution. Post-fix, payloads above 32 MiB are rejected. |
| Impact | This is a medium-severity, authenticated denial-of-service issue, not the remote-code-execution the single 'RCE' tag implies. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description and the fix: impact is availability-only (A:H, C:N/I:N), the attacker must be an authenticated/compromised edge peer (PR:L), and the trigger is a trivially crafted header (AC:L). CWE-789 (memory allocation with excessive size) matches the root cause - Reader.Read trusts the 32-bit PackageHeader.PayloadLen and allocates before bounds-checking. No EPSS, KEV, or public POC data was provided, so exploitation status is: no public exploit identified at time of analysis. The commit diff is a confirmed, verifiable fix (adds a 32 MiB MaxPayloadLen cap in reader.go and writer.go with regression tests), which corroborates the mechanism precisely. The description's explicit statement that this 'does not provide unauthenticated access or direct code execution' directly contradicts the 'RCE' tag - treat that tag as wrong. Net: a real but bounded operational-availability risk gated behind edge-peer authentication, not a top-priority critical flaw. |
| Exploit ScenarioDerived | A malicious or compromised KubeEdge edge node that has already authenticated to CloudHub repeatedly sends crafted viaduct message headers declaring an enormous PayloadLen. CloudHub allocates that memory before any upper-bound check, and sustained requests exhaust host memory, terminating CloudHub or driving it into a restart loop that disrupts all cloud-edge communication. No public exploit code was identified in the provided data, though the fix commit and tests make the mechanism straightforward to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Memory exhaustion in KubeEdge CloudHub (versions 1.0.0 through 1.21.1, 1.22.0 through 1.22.1, and 1.23.0) allows an authenticated, enrolled edge peer to terminate the cloud-side process or drive it into a restart loop by sending crafted viaduct frames whose 32-bit PackageHeader.PayloadLen declares a far larger payload than the frame contains. Impact is availability-only - no confidentiality or integrity loss and no code execution, which contradicts the single 'RCE' tag attached to the advisory; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5). There is no public exploit identified at time of analysis, and exploitation requires a valid edge-node credential or an established viaduct connection from a compromised node.
RemediationAI
Vendor-released patch: upgrade to KubeEdge v1.21.2, v1.22.2, or v1.23.1 (matching your release branch), available from https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2, https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2, and https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1; the fixes are the commits 0fe1ea18e5d7fde29633286ddf1c7e71cb39606f, 725a73ca35a65d91aa6338e52b8faaab6058f528, and cc79621943fff9d3f62638d9403ef0cfeda3d0e7 associated with PRs 7028, 7029, and 7030, which add a 32 MiB MaxPayloadLen bound in pkg/viaduct/pkg/packer (reader.go and writer.go) and reject oversized package headers. Because no configuration flag exists to enable this check pre-patch, the interim compensating controls are: (1) treat every enrolled edge node as a potential DoS source and immediately revoke and re-enroll certificates for any node believed to be compromised - this removes the single most likely attacker path (PR:L) but causes that node to lose cloud connectivity until it re-registers; (2) restrict network reachability to the CloudHub viaduct listener so only legitimately enrolled edge nodes can open sessions, which reduces exposure but does not protect against a malicious or compromised enrolled node; (3) apply container memory limits and restart back-off to the cloudcore pod and alert on repeated OOM kills or CloudHub restart loops, which bounds blast radius and improves detection but degrades cloud-edge communication while the limit is hit; and (4) monitor the GHSA-gfw4-49f9-cp25 advisory and the CHANGELOG branches for backported fixes to any maintained release line older than v1.21.2. Note that the advisory's 'RCE' tag is not supported by the assessed vector - no code execution or unauthenticated access is provided, so do not prioritize this as a remote-code-execution emergency over genuinely exploitable issues.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
KubeEdge's viaduct layer carries CloudHub-to-EdgeHub traffic, and its pkg/viaduct/pkg/packer package frames each message as a PackageHeader followed by a payload. The header carries a 32-bit PayloadLen field, and Reader.Read in pkg/viaduct/pkg/packer trusted that field, allocating a buffer of the declared size before any upper-bound validation. That is CWE-789 (Memory Allocation with Excessive Size Value): a small, cheaply transmitted header can request an arbitrarily large allocation, so a peer that repeats the frame can exhaust CloudHub's heap. The upstream fix introduces a MaxPayloadLen constant of 32 * 1024 * 1024 (32 MiB) and enforces it in both Reader.Read (rejecting headers above the limit with an 'exceeds maximum' error) and Writer.Write (refusing to emit oversized frames), with new reader_writer_test.go cases covering both the rejection and the within-limit paths. Because the vulnerable path is the message-processing routine reachable by any peer that already holds a viaduct session, the root cause is a missing protocol-level size bound rather than an authentication bypass; the CloudHub process, not the host operating system, is the intended target of the exhaustion.
Know when Kubeedge gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Authenticated edge peer (PR:L) sends a trivially crafted header (AC:L) over the network (AV:N) causing availability-only impact (A:H); no scope change beyond the CloudHub process.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Unauthenticated integrity manipulation in KubeEdge CloudCore through 1.23.1 allows any network-reachable attacker to sub
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at
KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to ho
Shell command injection in KubeEdge's v1alpha2 NodeUpgradeJob upgrade workflow allows an authenticated user who holds RB
Authenticated command injection in KubeEdge (1.21.0 up to 1.21.2, 1.22.2, and 1.23.1) lets a principal holding Kubernete
KubeEdge keadm releases from 1.16.0 before 1.21.2, 1.22.2, and 1.23.1 contain a path traversal in DecompressTarGz that,
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at
KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to ho
Exploit-DB