Log in Start free

Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-62370KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

Medium 6.5

In plain English

A medium-severity security flaw in kubeedge from kubeedge. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 56.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/kubeedge/kubeedge1.21.2GHSA-gfw4-49f9-cp25
Gogithub.com/kubeedge/kubeedge1.22.2GHSA-gfw4-49f9-cp25
Gogithub.com/kubeedge/kubeedge1.23.1GHSA-gfw4-49f9-cp25
Gogithub.com/kubeedge/kubeedge1.21.2, 1.22.2, 1.23.1GO-2026-6569

Affected products (as reported)

VendorProductVersions
kubeedge kubeedge >= 1.0.0, < 1.21.2>= 1.22.0, < 1.22.2>= 1.23.0, < 1.23.1

Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References