GHSA-2HW4-C9M4-F2FJ: CVE-2026-54462: Unbounded Request-Body Memory Exhaustion in Knative Admission Webhooks
CVE-2026-54462: Unbounded Request-Body Memory Exhaustion in Knative Admission Webhooks
> Vulnerability ID: GHSA-2HW4-C9M4-F2FJ
> CVSS Score: 6.5
> Published: 2026-10-28
An uncontrolled resource consumption vulnerability in the knative.dev/pkg/webhook package allows network-adjacent attackers within a Kubernetes cluster to trigger Out-Of-Memory (OOM) terminations of admission controller pods. The admission webhook HTTP server processes incoming AdmissionReview requests through an io.TeeReader and json.Decoder pipeline without enforcing an upper bound on request body size. Due to internal buffer reallocation mechanics, incoming payloads experience a 4.5x memory amplification factor. Because knative.dev/pkg provides the shared webhook server foundation for numerous cloud-native projects—including Knative Serving, Knative Eventing, Tekton, KEDA, Sigstore Policy Controller, and Kpack—exploitation can halt resource admission across entire Kubernetes clusters or bypass critical security validation policies.
TL;DR
The knative.dev/pkg admission webhook server fails to restrict HTTP request body sizes before buffering and decoding JSON payloads. A single oversized HTTP POST request from a pod-network client gets amplified by 4.5x in memory, triggering a container OOM-kill and disrupting cluster-wide resource admission across downstream projects like Knative, Tekton, KEDA, and Sigstore.
---
⚠️ Exploit Status: POC
Technical Details
- CVE ID: CVE-2026-54462 (GHSA-2hw4-c9m4-f2fj)
- Vulnerability Class: CWE-770: Allocation of Resources Without Limits or Throttling
- CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- EPSS Score: 0.38% (31.45th Percentile)
- Memory Amplification: 4.5x transmitted request body size
- Primary Impact: Admission Controller OOM-Kill / Cluster Admission DoS
- Patched Version: 0.0.0-20260531000007-52dbd5ece63f (3 MiB limit)
- CISA KEV Status: Not Listed
Affected Systems
- knative.dev/pkg
- Knative Serving
- Knative Eventing
- Tekton Pipelines
- Tekton Triggers
- KEDA
- Sigstore Policy Controller
- Kpack
- knative.dev/pkg: < 0.0.0-20260531000007-52dbd5ece63f (Fixed in: 0.0.0-20260531000007-52dbd5ece63f)
Code Analysis
Commit: 52dbd5e
Limit the webhook request body size to 3MiB (#3363)
--- a/webhook/webhook.go
+++ b/webhook/webhook.go
@@ -395,7 +395,9 @@ func (wh *Webhook) ServeHTTP(w http.ResponseWriter, r *http.Request) {
return
}
- wh.mux.ServeHTTP(w, r)
+ const MaxBodySize = 3 * 1024 * 1024 // 3 MiB
+ h := http.MaxBytesHandler(&wh.mux, MaxBodySize)
+ h.ServeHTTP(w, r)
}
Mitigation Strategies
- Enforce strict request body size limits at the HTTP server boundary using http.MaxBytesHandler or http.MaxBytesReader.
- Isolate admission webhook pods on the cluster network using Kubernetes NetworkPolicies so only the Kubernetes API server can reach the webhook port.
- Enforce mutual TLS (mTLS) client certificate verification on admission webhook listeners to reject connections from unauthorized pods.
Remediation Steps:
1. Update the knative.dev/pkg dependency in go.mod to version 0.0.0-20260531000007-52dbd5ece63f (commit 52dbd5ece63fe6d2d340ecbebec160550f460818) or newer.
2. Rebuild and redeploy downstream admission controller container images (Knative Serving/Eventing, Tekton, KEDA, Sigstore Policy Controller, Kpack).
3. Apply ingress Kubernetes NetworkPolicies in controller namespaces to drop pod-network traffic directed at TCP port 8443 from non-control-plane IP addresses.
References
- GitHub Security Advisory: GHSA-2hw4-c9m4-f2fj
- CVE-2026-54462 Official Record
- Knative pkg Pull Request #3363
- Patch Commit 52dbd5ece63fe6d2d340ecbebec160550f460818
- Knative pkg Repository
---
Read the full report for GHSA-2HW4-C9M4-F2FJ on our website for more details including interactive diagrams and full exploit analysis.
Mentions
GHSA-2HW4-C9M4-F2FJ: CVE-2026-54462: Unbounded Request-Body Memory Exhaustion in Knative Admission Webhooks CVE-2026-54462: Unbounded Request-Body Memory Exhaustion in Knative Admission Webhooks > Vulnerability ID: GHSA-2HW4-C9M4-F2FJ > CVSS Score: 6.5 > Published: 2026-10-28 An uncontrolled resource consumption vulnerability in the knative.dev/pkg/webhook package allows network-adjacent attackers within a Kubernetes cluster to trigger Out-Of-Memory (OOM) terminations of admission controller pods. The admission webhook HTTP server processes incoming AdmissionReview requests through an io.TeeReader and json.Decoder pipeline without enforcing an upper bound on request body size. Due to internal buffer reallocation mechanics, incoming payloads experience a 4.5x memory amplification factor. Because knative.dev/pkg provides the shared webhook server foundation for numerous cloud-native projects—including Knative Serving, Knative Eventing, Tekton, KEDA, Sigstore Policy Controller, and Kpack—exploitation can halt resource admission across entire Kubernetes clusters or bypass critical security validation policies. TL;DR The knative.dev/pkg admission webhook server fails to restrict HTTP request body sizes before buffering and decoding JSON payloads. A single oversized HTTP POST request from a pod-network client gets amplified by 4.5x in memory, triggering a container OOM-kill and disrupting cluster-wide resource admission across downstream projects like Knative, Tekton, KEDA, and Sigstore. --- ⚠️ Exploit Status: POC Technical Details - CVE ID: CVE-2026-54462 (GHSA-2hw4-c9m4-f2fj) - Vulnerability Class: CWE-770: Allocation of Resources Without Limits or Throttling - CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) - EPSS Score: 0.38% (31.45th Percentile) - Memory Amplification: 4.5x transmitted request body size - Primary Impact: Admission Controller OOM-Kill / Cluster Admission DoS - Patched Version: 0.0.0-20260531000007-52dbd5ece63f (3 MiB limit) - CISA KEV Status: Not Listed Affected Systems - knative.dev/pkg - Knative Serving - Knative Eventing - Tekton Pipelines - Tekton Triggers - KEDA - Sigstore Policy Controller - Kpack - knative.dev/pkg: < 0.0.0-20260531000007-52dbd5ece63f (Fixed in: 0.0.0-20260531000007-52dbd5ece63f) Code Analysis Commit: 52dbd5e Limit the webhook request body size to 3MiB (#3363) --- a/webhook/webhook.go +++ b/webhook/webhook.go @@ -395,7 +395,9 @@ func (wh *Webhook) ServeHTTP(w http.ResponseWriter, r *http.Request) { return } - wh.mux.ServeHTTP(w, r) + const MaxBodySize = 3 * 1024 * 1024 // 3 MiB + h := http.MaxBytesHandler(&wh.mux, MaxBodySize) + h.ServeHTTP(w, r) } Mitigation Strategies - Enforce strict request body size limits at the HTTP server boundary using http.MaxBytesHandler or http.MaxBytesReader. - Isolate admission webhook pods on the cluster network using Kubernetes NetworkPolicies so only the Kubernetes API server can reach the webhook port. - Enforce mutual TLS (mTLS) client certificate verification on admission webhook listeners to reject connections from unauthorized pods. Remediation Steps: 1. Update the knative.dev/pkg dependency in go.mod to version 0.0.0-20260531000007-52dbd5ece63f (commit 52dbd5ece63fe6d2d340ecbebec160550f460818) or newer. 2. Rebuild and redeploy downstream admission controller container images (Knative Serving/Eventing, Tekton, KEDA, Sigstore Policy Controller, Kpack). 3. Apply ingress Kubernetes NetworkPolicies in controller namespaces to drop pod-network traffic directed at TCP port 8443 from non-control-plane IP addresses. References - GitHub Security Advisory: GHSA-2hw4-c9m4-f2fj - CVE-2026-54462 Official Record - Knative pkg Pull Request #3363 - Patch Commit 52dbd5ece63fe6d2d340ecbebec160550f460818 - Knative pkg Repository --- Read the full report for GHSA-2HW4-C9M4-F2FJ on our website for more details including interactive diagrams and full exploit analysis.