CVE-2026-44247

highPriorität · verfolgen · 30EPSS 0.002 · 7. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.17% (7th) EPSS

CVSS 7.4 · high

Is it mine?

9 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · bewertet 2026-10-28

Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook server exposed to in-cluster traffic are affected. This vulnerability is fixed in v1.14.2, v1.13.3, and v1.12.4.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.4

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.8–7.4

v3.17.4highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 4

v3.16.8mediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:Hsecondary · ENISA EU

v3.16.8mediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:Hsecondary · security-advisories@github.comAusnutzbarkeit 2.3 · Auswirkung 4

v3.16.8mediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:Hsecondary · OSV

v3.16.8mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-400USCWE-400USCWE-770USCWE-770US

betroffene Produkte (9)

Betroffene Produkte und Versionsbereiche.

volcano-sh volcano≤ < 1.12.4enisa_euvdEU
volcano-sh volcano1.13.0, → 1.13.3enisa_euvdEU
volcano-sh volcano1.14.0-alpha.0, → 1.14.2enisa_euvdEU
linuxfoundation volcano< 1.12.4nvdUScpe:2.3:a:linuxfoundation:volcano:*:*:*:*:*:*:*:*
linuxfoundation volcano1.13.0 → 1.13.3nvdUScpe:2.3:a:linuxfoundation:volcano:*:*:*:*:*:*:*:*
linuxfoundation volcano1.14.0 → 1.14.2nvdUScpe:2.3:a:linuxfoundation:volcano:*:*:*:*:*:*:*:*
Go volcano.sh/volcano< 1.12.4osvUSpkg:golang/volcano.sh/volcano
Go volcano.sh/volcano1.13.0 → 1.13.3osvUSpkg:golang/volcano.sh/volcano
Go volcano.sh/volcano1.14.0 → 1.14.2osvUSpkg:golang/volcano.sh/volcano

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-8wxp-xxp2-rcgxVolcano's webhook server vulnerable to OOM due to unbounded HTTP request body size2026-05-08ghsa · osvUS
### Impact The Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook server exposed to in-cluster traffic are affected. ### Patches This issue will be fixed in the following versions: - v1.14.2 - v1.13.3 - v1.12.4 Users running versions below these should upgrade accordingly. ### Workarounds No known workarounds. Upgrade to the patched versions listed above.
GO-2026-5269Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size in volcano.sh/volcano2026-06-25vendor · osvUS
Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size in volcano.sh/volcano

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

veröffentlicht 2026-05-27geändert 2026-06-17

Referenzen (5)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan