CVE-2026-13322
LOW
INFO
Priority: 0.01
BB Relevance:
33/100
Published: 2026-06-26
Modified: 2026-10-25
First seen: 2026-10-29
Status: active
Attack Surface
Low Complexity
No Interaction
Scope Change
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Changed
C:
None
I:
None
A:
Low
Description
A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| kubevirt | kubevirt | - |
| redhat | openshift_virtualization | 4 – 4.22.0 |
References & Advisories (2)
Mitigation
Vendor Advisory
Issue Tracking
Vendor Advisory