Executive brief
Volcano, a batch scheduling system for Kubernetes, contains a vulnerability in its webhook server where it fails to limit the size of incoming data requests. An attacker with access to the internal network can send massive amounts of data to this server, causing it to crash due to memory exhaustion. This can disrupt the scheduling of high-performance computing workloads and impact the overall availability of the cluster management system.
Technical details
The Volcano webhook server fails to implement a maximum size limit for HTTP request bodies (CWE-770). An attacker operating a pod within the same cluster can send an arbitrarily large HTTP request to the webhook endpoint. This uncontrolled resource consumption leads to the webhook server process being terminated by the operating system's Out-of-Memory (OOM) killer. The vulnerability is reachable via the network from adjacent in-cluster traffic and requires low privileges. Patches are available in versions 1.12.4, 1.13.3, and 1.14.2.
Affected products
- volcano-sh Volcano < 1.12.4, >= 1.13.0 < 1.13.3, >= 1.14.0 < 1.14.2
Timeline
- 2026-05-08: disclosed
- 2026-05-08: advisory
- 2026-05-08: patched