GITHUB.COM/KUBEVIRT/KUBEVIRT · CVE-2026-13322 · Infrastructure
NO FIX YET · SEE WHAT TO DO
KubeVirt's downward metrics virtio-serial server reads guest input with no length limit, so it buffers data until a newline arrives. A user inside a VM can stream bytes to that device and make the virt-handler process allocate memory until the kernel kills it.
first public Jun 26, 2026 · 2 sources
Running Github.com/kubevirt/kubevirt? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only clusters running KubeVirt between 1.1.0-alpha.0 and 1.10.0-rc.0 where VMs have the downward metrics virtio-serial device configured are exposed. The attacker must control a guest VM that has that device, so clusters with no such VMs or with only trusted guests can skip it. The sources do not say whether the device is on by default.
Not affected if no-downward-metrics-device, trusted-guests-only
Who cares cwe-770, kubernetes, kubevirt, virtualization
kubectl get kubevirt -n kubevirt -o jsonpath='{.items[0].status.observedKubeVirtVersion}'downwardMetrics under spec.template.spec.domain.devices in the VirtualMachine or VirtualMachineInstance objects>= 1.1.0-alpha.0 and A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.
<= 1.10.0-rc.0This page as .md · .json · in your agent: get_signal("CVE-2026-13322") · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.