CVE-2026-44247 json
Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body size
published 6mo ago modified 4mo ago also GHSA-8wxp-xxp2-rcgx , GO-2026-5269 , EUVD-2026-32666
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 6%
- public exploits
- 0
- none known
Summary
Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook server exposed to in-cluster traffic are affected. This vulnerability is fixed in v1.14.2, v1.13.3, and v1.12.4.
Patch / fix
- go volcano.sh/volcano 1.12.4, 1.13.3, 1.14.2
- linuxfoundation volcano 1.12.4, 1.13.3, 1.14.2
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
Is CVE-2026-44247 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5mo ago
Exploit prediction
0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
| NVD | 3.1 | 7.4 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | volcano.sh/volcano | <1.12.4 >=1.13.0, <1.13.3 >=1.14.0, <1.14.2 |
1.12.4 1.13.3 1.14.2 |
Affected products
- volcano-sh volcano
Classification
References
-
github.com
/volcano-sh/volcano/security/advisories/GHSA-8wxp-xxp2-rcgx
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-44247
advisory
-
github.com
/volcano-sh/volcano
package
Sources
- CVE List CVE-2026-44247
- GitHub Advisory GHSA-8wxp-xxp2-rcgx
- NVD CVE-2026-44247
- OSV GO-2026-5269
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.