GHSA-2HW4-C9M4-F2FJ: CVE-2026-54462: Unbounded Request-Body Memory Exhaustion in Knative Admission Webhooks
CVSS Score: 6.5 Published: 2026-10-28 Full Report: https://cvereports.com/reports/GHSA-2HW4-C9M4-F2FJ
An uncontrolled resource consumption vulnerability in the knative.dev/pkg/webhook package allows network-adjacent attackers within a Kubernetes cluster to trigger Out-Of-Memory (OOM) terminations of admission controller pods. The admission webhook HTTP server processes incoming AdmissionReview requests through an io.TeeReader and json.Decoder pipeline without enforcing an upper bound on request body size. Due to internal buffer reallocation mechanics, incoming payloads experience a 4.5x memory amplification factor. Because knative.dev/pkg provides the shared webhook server foundation for numerous cloud-native projects—including Knative Serving, Knative Eventing, Tekton, KEDA, Sigstore Policy Controller, and Kpack—exploitation can halt resource admission across entire Kub