Log in Start free

Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-40924Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in pipeline from tektoncd. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 75.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http implementations. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/tektoncd/pipeline1.11.1GHSA-m2cx-gpqf-qf74
Gogithub.com/tektoncd/pipeline1.0.2GHSA-m2cx-gpqf-qf74
Gogithub.com/tektoncd/pipeline1.3.4GHSA-m2cx-gpqf-qf74
Gogithub.com/tektoncd/pipeline1.6.2GHSA-m2cx-gpqf-qf74
Gogithub.com/tektoncd/pipeline1.9.3GHSA-m2cx-gpqf-qf74
Gogithub.com/tektoncd/pipeline1.0.2, 1.11.1, 1.3.4, 1.6.2, 1.9.3GO-2026-5486

Affected products (as reported)

VendorProductVersions
tektoncd pipeline >= 1.0.0, < 1.0.2>= 1.2.0, < 1.3.4>= 1.4.0, < 1.6.2>= 1.7.0, < 1.9.3>= 1.10.0, < 1.11.1

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References