{"id":"CVE-2026-13322","kind":"vulnerability","aliases":["CVE-2026-13322","GHSA-6f2p-2qg2-qqch"],"related":[],"title":"KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption","description":"A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.","summary":"KubeVirt's downward metrics virtio-serial server reads guest input with no length limit, so it buffers data until a newline arrives. A user inside a VM can stream bytes to that device and make the virt-handler process allocate memory until the kernel kills it.","severity":"low","cvss":3.8,"epss":0.00134,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/kubevirt/kubevirt","fixed":[],"affected":">= 1.1.0-alpha.0, <= 1.10.0-rc.0","ecosystem":"go"},{"name":"redhat openshift virtualization","fixed":[],"affected":">= 4, <= 4.22.0","ecosystem":"vendor"},{"name":"kubevirt","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["go","vendor"],"tags":["cwe-770","infrastructure","kubernetes","kubevirt","virtualization"],"not_affected_if":["no-downward-metrics-device","trusted-guests-only"],"how_to_check":"- Check the KubeVirt version with `kubectl get kubevirt -n kubevirt -o jsonpath='{.items[0].status.observedKubeVirtVersion}'`\n- Check whether any VM sets the downward metrics device: look for `downwardMetrics` under `spec.template.spec.domain.devices` in the VirtualMachine or VirtualMachineInstance objects\n- Check the version is in the affected range `>= 1.1.0-alpha.0` and `<= 1.10.0-rc.0`","fix":"- KubeVirt fixed version: unknown (the sources do not name a fixed release)","status":"open","published_at":"2026-06-26T00:16:51+00:00","first_seen_at":"2026-11-04T17:20:43+00:00","triaged_at":"2026-11-04T17:22:30+00:00","updated_at":"2026-11-04T17:28:12+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-04T17:22:30Z","model":"claude-haiku-5-5","output":{"fix":"- KubeVirt fixed version: unknown (the sources do not name a fixed release)","reach":"local","title":"KubeVirt: downward metrics server lets a VM guest exhaust host memory","impact":"low","summary":"KubeVirt's downward metrics virtio-serial server reads guest input with no length limit, so it buffers data until a newline arrives. A user inside a VM can stream bytes to that device and make the virt-handler process allocate memory until the kernel kills it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kubevirt","kubernetes","virtualization"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"virt-handler exhausts memory and is OOM-killed on the host","analyst_note":"Confirm the fixed KubeVirt version and whether the downward metrics device is enabled by default, using the GHSA-6f2p-2qg2-qqch advisory page.","how_to_check":"- Check the KubeVirt version with `kubectl get kubevirt -n kubevirt -o jsonpath='{.items[0].status.observedKubeVirtVersion}'`\n- Check whether any VM sets the downward metrics device: look for `downwardMetrics` under `spec.template.spec.domain.devices` in the VirtualMachine or VirtualMachineInstance objects\n- Check the version is in the affected range `>= 1.1.0-alpha.0` and `<= 1.10.0-rc.0`","plain_action":"","needs_analyst":true,"not_affected_if":["no-downward-metrics-device","trusted-guests-only"],"who_is_affected":"Only clusters running KubeVirt between 1.1.0-alpha.0 and 1.10.0-rc.0 where VMs have the downward metrics virtio-serial device configured are exposed. The attacker must control a guest VM that has that device, so clusters with no such VMs or with only trusted guests can skip it. The sources do not say whether the device is on by default.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00079,"input_tokens":4254,"output_tokens":730,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-13322':15A,23A '-2026':14A,22A '-770':32B '/kubevirt/kubevirt':26A '2qg2':19A '6f2p':18A 'access':124C 'alloc':78B,151C 'arriv':59B 'buffer':54B,105C 'byte':67B,143C 'caus':148C 'charact':111C 'configur':138C 'consumpt':12A 'continu':142C 'cve':13A,21A 'cwe':31B 'data':55B 'deadlin':120C 'devic':70B,137C,147C 'downward':2A,39B,91C,132C 'flaw':85C 'found':87C 'ghsa':17A 'ghsa-6f2p-2qg2-qqch':16A 'github.com':25A 'github.com/kubevirt/kubevirt':24A 'guest':46B,100C,128C 'handler':76B,156C 'indefinit':107C 'infrastructur':33B 'input':47B,106C 'insid':62B 'kernel':82B 'kill':83B,163C 'kubernet':34B 'kubevirt':1A,30A,35B,37B,89C 'length':50B,116C 'limit':51B,117C 'make':72B 'memori':11A,79B,150C 'metric':3A,40B,92C,133C 'newlin':58B,110C 'oom':162C 'oom-kil':161C 'openshift':28A 'process':77B,157C 'qqch':20A 'read':45B,99C,119C 'receiv':113C 'redhat':27A 'request':101C 'serial':6A,43B,95C,136C 'server':7A,44B,96C,98C 'stream':66B,144C 'textproto.reader.readline':103C 'unbound':10A,149C 'use':102C 'user':61B,122C 'virt':75B,155C 'virt-handl':74B,154C 'virtio':5A,42B,94C,135C 'virtio-seri':4A,41B,93C,134C 'virtual':36B 'virtualization':29A 'vm':64B,127C 'vulner':8A 'write':140C","nicknames":[],"mitigations":[],"who_affected":"Only clusters running KubeVirt between 1.1.0-alpha.0 and 1.10.0-rc.0 where VMs have the downward metrics virtio-serial device configured are exposed. The attacker must control a guest VM that has that device, so clusters with no such VMs or with only trusted guests can skip it. The sources do not say whether the device is on by default.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["githubcomkubevirtkubevirt","kubevirt","openshiftvirtualization","redhatopenshiftvirtualization"],"ptokens":["com","github","kubevirt","openshift","redhat","virtualization"],"labels":["cwe770","go","infrastructure","kubernetes","kubevirt","low","vendor","virtualization"],"campaign_type":null,"first_public_at":"2026-06-26T00:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-6f2p-2qg2-qqch","url":"https://github.com/advisories/GHSA-6f2p-2qg2-qqch","severity":"low","published_at":"2026-06-26T00:32:07+00:00","modified_at":"2026-11-04T17:16:08+00:00","first_seen_at":"2026-11-04T17:20:43+00:00","fetched_at":"2026-11-04T17:25:52+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-13322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13322","severity":null,"published_at":"2026-06-26T00:16:51+00:00","modified_at":"2026-10-25T22:10:00+00:00","first_seen_at":"2026-11-04T17:28:12+00:00","fetched_at":"2026-11-04T17:28:12+00:00","note":null}],"documents":[{"id":68869,"url":"https://access.redhat.com/security/cve/CVE-2026-13322","title":"Vendor advisory: access.redhat.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: access.redhat.com"},{"id":68870,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492681","title":"Vendor advisory: bugzilla.redhat.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: bugzilla.redhat.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}