CVE-2026-44247

highpriority · track · 30EPSS 0.002 · 7 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.17% (7th) EPSS

CVSS 7.4 · high

Is it mine?

9 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-28

Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook server exposed to in-cluster traffic are affected. This vulnerability is fixed in v1.14.2, v1.13.3, and v1.12.4.

cvss

Technical severity, 0–10. One row per scoring source.

7.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–7.4

v3.17.4highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 4

v3.16.8mediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:Hsecondary · ENISA EU

v3.16.8mediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:Hsecondary · security-advisories@github.comexploitability 2.3 · impact 4

v3.16.8mediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:Hsecondary · OSV

v3.16.8mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-400USCWE-400USCWE-770USCWE-770US

affected products (9)

Products and version ranges known to be affected.

volcano-sh volcano≤ < 1.12.4enisa_euvdEU
volcano-sh volcano1.13.0, → 1.13.3enisa_euvdEU
volcano-sh volcano1.14.0-alpha.0, → 1.14.2enisa_euvdEU
linuxfoundation volcano< 1.12.4nvdUScpe:2.3:a:linuxfoundation:volcano:*:*:*:*:*:*:*:*
linuxfoundation volcano1.13.0 → 1.13.3nvdUScpe:2.3:a:linuxfoundation:volcano:*:*:*:*:*:*:*:*
linuxfoundation volcano1.14.0 → 1.14.2nvdUScpe:2.3:a:linuxfoundation:volcano:*:*:*:*:*:*:*:*
Go volcano.sh/volcano< 1.12.4osvUSpkg:golang/volcano.sh/volcano
Go volcano.sh/volcano1.13.0 → 1.13.3osvUSpkg:golang/volcano.sh/volcano
Go volcano.sh/volcano1.14.0 → 1.14.2osvUSpkg:golang/volcano.sh/volcano

advisories (2)

Vendor and ecosystem advisories describing this.

GHSA-8wxp-xxp2-rcgxVolcano's webhook server vulnerable to OOM due to unbounded HTTP request body size2026-05-08ghsa · osvUS
### Impact The Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook server exposed to in-cluster traffic are affected. ### Patches This issue will be fixed in the following versions: - v1.14.2 - v1.13.3 - v1.12.4 Users running versions below these should upgrade accordingly. ### Workarounds No known workarounds. Upgrade to the patched versions listed above.
GO-2026-5269Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size in volcano.sh/volcano2026-06-25vendor · osvUS
Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size in volcano.sh/volcano

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

published 2026-05-27modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan