Executive brief
A denial-of-service vulnerability exists in KubeVirt, a tool used to run virtual machines within Kubernetes clusters. An attacker with access to a guest virtual machine can send a continuous stream of data to a specific internal service, causing the host management process to consume all available memory. This results in the management service being terminated by the operating system, potentially disrupting the management of all virtual machines on that specific host.
Technical details
A vulnerability was identified in KubeVirt's downward metrics virtio-serial server within the virt-handler component. The server utilizes 'textproto.Reader.ReadLine()' to process guest requests, which lacks a length limit or read deadline, causing it to buffer input indefinitely until a newline character is encountered. An attacker with local access to a VM guest configured with the downward metrics virtio-serial device can transmit a continuous byte stream without newlines. This leads to unbounded heap allocation in the virt-handler process, eventually triggering an Out-of-Memory (OOM) kill. Because virt-handler manages multiple VMs on a node, this impacts the availability of management services for the entire host.
Affected products
- KubeVirt KubeVirt unspecified
- Red Hat OpenShift Virtualization 4 4
Timeline
- 2026-06-25: disclosed: Initial report in Red Hat Bugzilla
- 2026-06-26: advisory: NVD publication date