Vulnerability-Lookup

CVE-2026-62370 (GCVE-0-2026-62370)

Vulnerability from cvelistv5 – Published: 2026-09-21 17:07 – Updated: 2026-09-21 17:07

Title

KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

Summary

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M mitre root

References

13 references

URL	Tags
https://github.com/kubeedge/kubeedge/security/adv…	x_refsource_CONFIRM
https://github.com/kubeedge/kubeedge/pull/7028	x_refsource_MISC
https://github.com/kubeedge/kubeedge/pull/7029	x_refsource_MISC
https://github.com/kubeedge/kubeedge/pull/7030	x_refsource_MISC
https://github.com/kubeedge/kubeedge/commit/0fe1e…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/commit/725a7…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/commit/cc796…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/blob/master/…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/blob/master/…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/blob/master/…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/releases/tag…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/releases/tag…	x_refsource_MISC
https://github.com/kubeedge/kubeedge/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
kubeedge	kubeedge	Affected: >= 1.0.0, < 1.21.2 Affected: >= 1.22.0, < 1.22.2 Affected: >= 1.23.0, < 1.23.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "kubeedge",
          "vendor": "kubeedge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.21.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.22.0, \u003c 1.22.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.23.0, \u003c 1.23.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T17:07:31.398Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kubeedge/kubeedge/security/advisories/GHSA-gfw4-49f9-cp25",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kubeedge/kubeedge/security/advisories/GHSA-gfw4-49f9-cp25"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/pull/7028",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/pull/7028"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/pull/7029",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/pull/7029"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/pull/7030",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/pull/7030"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/commit/0fe1ea18e5d7fde29633286ddf1c7e71cb39606f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/commit/0fe1ea18e5d7fde29633286ddf1c7e71cb39606f"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/commit/725a73ca35a65d91aa6338e52b8faaab6058f528",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/commit/725a73ca35a65d91aa6338e52b8faaab6058f528"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/commit/cc79621943fff9d3f62638d9403ef0cfeda3d0e7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/commit/cc79621943fff9d3f62638d9403ef0cfeda3d0e7"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2"
        },
        {
          "name": "https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"
        }
      ],
      "source": {
        "advisory": "GHSA-gfw4-49f9-cp25",
        "discovery": "UNKNOWN"
      },
      "title": "KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62370",
    "datePublished": "2026-09-21T17:07:31.398Z",
    "dateReserved": "2026-07-13T22:04:59.678Z",
    "dateUpdated": "2026-09-21T17:07:31.398Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-62370",
      "date": "2026-09-23",
      "epss": "0.00504",
      "percentile": "0.42124"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "kubeedge",
                "vendor": "kubeedge",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.0.0, \u003c 1.21.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.22.0, \u003c 1.22.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.23.0, \u003c 1.23.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1."
          }
        ],
        "id": "CVE-2026-62370",
        "lastModified": "2026-09-21T17:17:36.957",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-21T17:17:36.957",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/commit/0fe1ea18e5d7fde29633286ddf1c7e71cb39606f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/commit/725a73ca35a65d91aa6338e52b8faaab6058f528"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/commit/cc79621943fff9d3f62638d9403ef0cfeda3d0e7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/pull/7028"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/pull/7029"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/pull/7030"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kubeedge/kubeedge/security/advisories/GHSA-gfw4-49f9-cp25"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-789"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2026-62370

Vulnerability from fkie_nvd - Published: 2026-09-21 17:17 - Updated: 2026-09-21 17:17

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/commit/0fe1ea18e5d7fde29633286ddf1c7e71cb39606f
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/commit/725a73ca35a65d91aa6338e52b8faaab6058f528
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/commit/cc79621943fff9d3f62638d9403ef0cfeda3d0e7
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/pull/7028
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/pull/7029
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/pull/7030
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1
	security-advisories@github.com	https://github.com/kubeedge/kubeedge/security/advisories/GHSA-gfw4-49f9-cp25

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "kubeedge",
          "vendor": "kubeedge",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 1.21.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.22.0, \u003c 1.22.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.23.0, \u003c 1.23.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1."
    }
  ],
  "id": "CVE-2026-62370",
  "lastModified": "2026-09-21T17:17:36.957",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-21T17:17:36.957",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/commit/0fe1ea18e5d7fde29633286ddf1c7e71cb39606f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/commit/725a73ca35a65d91aa6338e52b8faaab6058f528"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/commit/cc79621943fff9d3f62638d9403ef0cfeda3d0e7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/pull/7028"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/pull/7029"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/pull/7030"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kubeedge/kubeedge/security/advisories/GHSA-gfw4-49f9-cp25"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-GFW4-49F9-CP25

Vulnerability from github – Published: 2026-09-22 20:37 – Updated: 2026-09-22 20:37

Summary

KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

Details

Summary

KubeEdge CloudHub uses the viaduct packer to decode messages received from connected peers. The packer reads a 32-bit payload length from the message header and previously allocated a buffer of that size without enforcing an upper bound.

An authenticated peer that can establish a viaduct connection to CloudHub can send a crafted message header containing an excessively large payload length. This may cause CloudHub to allocate a large amount of memory and can result in memory exhaustion, process termination, or denial of service.

Impact

A successfully authenticated malicious or compromised edge node may repeatedly send crafted viaduct message headers to increase CloudHub memory consumption.

Depending on available memory and deployment limits, exploitation may cause:

Increased CloudHub memory usage
Out-of-memory termination
CloudHub restart loops
Temporary disruption of cloud-edge communication

Authentication to the viaduct endpoint is required. This issue does not provide unauthenticated access or direct code execution.

Root cause

The viaduct packer trusted the payload length encoded in the message header and allocated the payload buffer before validating whether the declared length was within an acceptable range.

Fix

The fix introduces a maximum viaduct payload size of 32 MiB.

The updated implementation:

Rejects oversized payload lengths in the reader before memory allocation
Enforces the same maximum size in the writer
Adds regression tests covering oversized and valid payloads

Fixes have been prepared for the following patch releases:

KubeEdge v1.23.1
KubeEdge v1.22.2
KubeEdge v1.21.2

These versions should not be listed as released until the coordinated release process is complete.

Workarounds

Before patched versions are available, operators should:

Restrict access to the CloudHub endpoint to trusted edge nodes and networks
Protect and rotate edge-node credentials
Revoke credentials belonging to decommissioned or potentially compromised nodes
Apply memory limits and restart policies to the CloudHub workload
Monitor CloudHub memory consumption and unexpected connection activity

Affected component

pkg/viaduct/pkg/packer
CloudHub viaduct message-processing path

Credits

KubeEdge thanks Sang-Hoon Choi (KoreaSecurity, Sejong University) for responsibly reporting this issue and for coordinating with the KubeEdge maintainers through the security disclosure process.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kubeedge/kubeedge"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.21.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kubeedge/kubeedge"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.22.0"
            },
            {
              "fixed": "1.22.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kubeedge/kubeedge"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.23.0"
            },
            {
              "fixed": "1.23.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62370"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:37:01Z",
    "nvd_published_at": "2026-09-21T17:17:36Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nKubeEdge CloudHub uses the viaduct packer to decode messages received from connected peers. The packer reads a 32-bit payload length from the message header and previously allocated a buffer of that size without enforcing an upper bound.\n\nAn authenticated peer that can establish a viaduct connection to CloudHub can send a crafted message header containing an excessively large payload length. This may cause CloudHub to allocate a large amount of memory and can result in memory exhaustion, process termination, or denial of service.\n\n## Impact\n\nA successfully authenticated malicious or compromised edge node may repeatedly send crafted viaduct message headers to increase CloudHub memory consumption.\n\nDepending on available memory and deployment limits, exploitation may cause:\n\n* Increased CloudHub memory usage\n* Out-of-memory termination\n* CloudHub restart loops\n* Temporary disruption of cloud-edge communication\n\nAuthentication to the viaduct endpoint is required. This issue does not provide unauthenticated access or direct code execution.\n\n## Root cause\n\nThe viaduct packer trusted the payload length encoded in the message header and allocated the payload buffer before validating whether the declared length was within an acceptable range.\n\n## Fix\n\nThe fix introduces a maximum viaduct payload size of 32 MiB.\n\nThe updated implementation:\n\n* Rejects oversized payload lengths in the reader before memory allocation\n* Enforces the same maximum size in the writer\n* Adds regression tests covering oversized and valid payloads\n\nFixes have been prepared for the following patch releases:\n\n* KubeEdge v1.23.1\n* KubeEdge v1.22.2\n* KubeEdge v1.21.2\n\nThese versions should not be listed as released until the coordinated release process is complete.\n\n## Workarounds\n\nBefore patched versions are available, operators should:\n\n* Restrict access to the CloudHub endpoint to trusted edge nodes and networks\n* Protect and rotate edge-node credentials\n* Revoke credentials belonging to decommissioned or potentially compromised nodes\n* Apply memory limits and restart policies to the CloudHub workload\n* Monitor CloudHub memory consumption and unexpected connection activity\n\n## Affected component\n\n* `pkg/viaduct/pkg/packer`\n* CloudHub viaduct message-processing path\n\n## Credits\n\nKubeEdge thanks Sang-Hoon Choi ([KoreaSecurity](https://github.com/KoreaSecurity), Sejong University)\nfor responsibly reporting this issue and for coordinating with the KubeEdge\nmaintainers through the security disclosure process.",
  "id": "GHSA-gfw4-49f9-cp25",
  "modified": "2026-09-22T20:37:02Z",
  "published": "2026-09-22T20:37:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/security/advisories/GHSA-gfw4-49f9-cp25"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62370"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/pull/7028"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/pull/7029"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/pull/7030"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/commit/0fe1ea18e5d7fde29633286ddf1c7e71cb39606f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/commit/725a73ca35a65d91aa6338e52b8faaab6058f528"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/commit/cc79621943fff9d3f62638d9403ef0cfeda3d0e7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kubeedge/kubeedge"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.21.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.22.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeedge/kubeedge/releases/tag/v1.23.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-62370 (GCVE-0-2026-62370)

FKIE_CVE-2026-62370

GHSA-GFW4-49F9-CP25

Summary

Impact

Root cause

Fix

Workarounds

Affected component

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour