CVE-2026-62370: KubeEdge CloudHub unbounded buffer allocation in viaduct packer

CVE-2026-62370 · Severity: medium · CVSS 6.5 · Published 2026-09-21

KubeEdge CloudHub is middleware that manages communication between cloud control planes and edge computing nodes in Kubernetes environments. An authenticated edge node can exploit a flaw in the viaduct message handler to trigger excessive memory allocation on CloudHub, causing the service to exhaust memory, crash, or enter restart loops—disrupting cloud-edge synchronization without requiring code execution.

Technologies: github.com/kubeedge/kubeedge (Go). Vendors: Go, KubeEdge.

Quick answers

Is CVE-2026-62370 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62370 being exploited in the wild.
How severe is CVE-2026-62370?
Medium severity, with a CVSS score of 6.5, published 21 September 2026.
Which products and versions are affected?
github.com/kubeedge/kubeedge (Go) SEMVER:introduced=1.0.0,fixed=1.21.2, SEMVER:introduced=1.0.0,fixed=1.21.2,introduced=1.22.0,fixed=1.22.2,introduced=1.23.0,fixed=1.23.1; KubeEdge CloudHub before v1.21.2, v1.22.2, v1.23.1.
Is there a fix for CVE-2026-62370?
Yes. github.com/kubeedge/kubeedge (Go): upgrade to 1.21.2, 1.23.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62370 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-62370?
Check whether you run github.com/kubeedge/kubeedge (Go) or KubeEdge CloudHub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/kubeedge/kubeedge (Go): upgrade to 1.21.2, 1.23.1 or later
    go get github.com/kubeedge/kubeedge@v1.23.1

Technical details

The vulnerability is a resource exhaustion (CWE-770) flaw in the viaduct packer component used by CloudHub to decode peer messages. The packer reads a 32-bit payload length from the message header and allocates a buffer without validating that the declared size falls within acceptable limits. An authenticated attacker (a compromised or malicious edge node with valid credentials) can send a crafted viaduct message header with an excessively large payload length, causing CloudHub to allocate gigabytes of memory before validation. This exhausts available memory, triggers out-of-memory termination, or causes denial of service. Authentication to the viaduct endpoint is required; unauthenticated remote exploitation is not possible. The fix introduces a 32 MiB maximum payload size and rejects oversized lengths before memory allocation.

Affected products

  • KubeEdge CloudHub before v1.21.2, v1.22.2, v1.23.1

Identifiers

  • CVE-2026-62370
  • GHSA-gfw4-49f9-cp25
  • GO-2026-6569

Timeline

  • 2026-09-22: disclosed: GHSA-gfw4-49f9-cp25 published
  • 2026-09-22: patched: Patches prepared for v1.23.1, v1.22.2, v1.21.2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.