Executive brief
KubeEdge CloudHub is middleware that manages communication between cloud control planes and edge computing nodes in Kubernetes environments. An authenticated edge node can exploit a flaw in the viaduct message handler to trigger excessive memory allocation on CloudHub, causing the service to exhaust memory, crash, or enter restart loops—disrupting cloud-edge synchronization without requiring code execution.
Technical details
The vulnerability is a resource exhaustion (CWE-770) flaw in the viaduct packer component used by CloudHub to decode peer messages. The packer reads a 32-bit payload length from the message header and allocates a buffer without validating that the declared size falls within acceptable limits. An authenticated attacker (a compromised or malicious edge node with valid credentials) can send a crafted viaduct message header with an excessively large payload length, causing CloudHub to allocate gigabytes of memory before validation. This exhausts available memory, triggers out-of-memory termination, or causes denial of service. Authentication to the viaduct endpoint is required; unauthenticated remote exploitation is not possible. The fix introduces a 32 MiB maximum payload size and rejects oversized lengths before memory allocation.
Affected products
- KubeEdge CloudHub before v1.21.2, v1.22.2, v1.23.1
Timeline
- 2026-09-22: disclosed: GHSA-gfw4-49f9-cp25 published
- 2026-09-22: patched: Patches prepared for v1.23.1, v1.22.2, v1.21.2