CVE-2026-13322

A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.

CVSS v3 3.8 LOW

3.8^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-13322	Mitigation Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2492681	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:*

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Se encontró un fallo en el servidor virtio-serial de métricas descendentes de KubeVirt. El servidor lee las solicitudes del invitado usando textproto.Reader.ReadLine(), que almacena en búfer la entrada de forma indefinida hasta que se recibe un carácter de nueva línea, sin límite de longitud ni plazo de lectura. Un usuario con acceso a un invitado de VM que tiene configurado el dispositivo virtio-serial de métricas descendentes puede escribir un flujo continuo de bytes en el dispositivo, causando una asignación de memoria ilimitada en el proceso virt-gestor hasta que es eliminado por OOM.

Information

Published : 2026-06-26 00:16

Updated : 2026-10-25 22:10

NVD link : CVE-2026-13322

Mitre link : CVE-2026-13322

CVE.ORG link : CVE-2026-13322

JSON object : View

Products Affected

kubevirt

kubevirt

redhat

openshift_virtualization

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-13322", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13322", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T13:39:04.943661Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.0}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:container_native_virtualization:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Virtualization 4", "packageName": "container-native-virtualization/virt-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:container_native_virtualization:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Virtualization 4", "packageName": "container-native-virtualization/virt-handler-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-06-26T00:16:51.397", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-13322", "tags": ["Mitigation", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492681", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en el servidor virtio-serial de m\u00e9tricas descendentes de KubeVirt. El servidor lee las solicitudes del invitado usando textproto.Reader.ReadLine(), que almacena en b\u00fafer la entrada de forma indefinida hasta que se recibe un car\u00e1cter de nueva l\u00ednea, sin l\u00edmite de longitud ni plazo de lectura. Un usuario con acceso a un invitado de VM que tiene configurado el dispositivo virtio-serial de m\u00e9tricas descendentes puede escribir un flujo continuo de bytes en el dispositivo, causando una asignaci\u00f3n de memoria ilimitada en el proceso virt-gestor hasta que es eliminado por OOM."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5301905C-9B5C-479F-A69A-659C6CB3AA42", "versionEndIncluding": "4.22.0", "versionStartIncluding": "4"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:*", "vulnerable": true, "matchCriteriaId": "06AF9668-6158-47F4-A755-0EE4D5F7F413"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}