Pkg
Monthly
Memory exhaustion in the shared knative.dev/pkg admission webhook handler allows a pod-network attacker to OOM-kill any controller built on the library by sending one oversized POST to its admission endpoint. All knative.dev/pkg versions prior to 0.0.0-20260531000007-52dbd5ece63f are affected, and the flaw propagates to every downstream consumer of the shared webhook server - Knative Serving and Eventing, Tekton Pipelines and Triggers, KEDA, Sigstore policy-controller and Kpack - because none of them bound the request body before decoding. Impact is availability-only: with failurePolicy=Fail the OOM becomes a namespace or cluster admission outage, with failurePolicy=Ignore only the affected webhook goes offline; the advisory includes a reproduction script and measured memory-amplification logs, but there is no public exploit identified at time of analysis in the sense of confirmed attack activity and the issue is not in CISA KEV. A vendor patch is available, and the assessed priority is to remediate this month rather than as an emergency.
pkg is tool design to bundle Node.js projects into an executables. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Memory exhaustion in the shared knative.dev/pkg admission webhook handler allows a pod-network attacker to OOM-kill any controller built on the library by sending one oversized POST to its admission endpoint. All knative.dev/pkg versions prior to 0.0.0-20260531000007-52dbd5ece63f are affected, and the flaw propagates to every downstream consumer of the shared webhook server - Knative Serving and Eventing, Tekton Pipelines and Triggers, KEDA, Sigstore policy-controller and Kpack - because none of them bound the request body before decoding. Impact is availability-only: with failurePolicy=Fail the OOM becomes a namespace or cluster admission outage, with failurePolicy=Ignore only the affected webhook goes offline; the advisory includes a reproduction script and measured memory-amplification logs, but there is no public exploit identified at time of analysis in the sense of confirmed attack activity and the issue is not in CISA KEV. A vendor patch is available, and the assessed priority is to remediate this month rather than as an emergency.
pkg is tool design to bundle Node.js projects into an executables. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.