# CVE-2026-62370: KubeEdge CloudHub unbounded buffer allocation in viaduct packer

Source: https://junglewise.ai/threats/cve-2026-62370-kubeedge-cloudhub-unbounded-buffer-allocation-in-viaduct-packer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62370 · Severity: medium · CVSS 6.5 · Published 2026-09-21

KubeEdge CloudHub is middleware that manages communication between cloud control planes and edge computing nodes in Kubernetes environments. An authenticated edge node can exploit a flaw in the viaduct message handler to trigger excessive memory allocation on CloudHub, causing the service to exhaust memory, crash, or enter restart loops—disrupting cloud-edge synchronization without requiring code execution.

Technologies: [github.com/kubeedge/kubeedge (Go)](https://junglewise.ai/threats/technologies/github-com-kubeedge-kubeedge). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [KubeEdge](https://junglewise.ai/threats/vendors/kubeedge).

## Quick answers

**Is CVE-2026-62370 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62370 being exploited in the wild.

**How severe is CVE-2026-62370?** Medium severity, with a CVSS score of 6.5, published 21 September 2026.

**Which products and versions are affected?** github.com/kubeedge/kubeedge (Go) SEMVER:introduced=1.0.0,fixed=1.21.2, SEMVER:introduced=1.0.0,fixed=1.21.2,introduced=1.22.0,fixed=1.22.2,introduced=1.23.0,fixed=1.23.1; KubeEdge CloudHub before v1.21.2, v1.22.2, v1.23.1.

**Is there a fix for CVE-2026-62370?** Yes. github.com/kubeedge/kubeedge (Go): upgrade to 1.21.2, 1.23.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62370 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-62370?** Check whether you run github.com/kubeedge/kubeedge (Go) or KubeEdge CloudHub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/kubeedge/kubeedge (Go): upgrade to 1.21.2, 1.23.1 or later

  ```sh
  go get github.com/kubeedge/kubeedge@v1.23.1
  ```


## Technical details

The vulnerability is a resource exhaustion (CWE-770) flaw in the viaduct packer component used by CloudHub to decode peer messages. The packer reads a 32-bit payload length from the message header and allocates a buffer without validating that the declared size falls within acceptable limits. An authenticated attacker (a compromised or malicious edge node with valid credentials) can send a crafted viaduct message header with an excessively large payload length, causing CloudHub to allocate gigabytes of memory before validation. This exhausts available memory, triggers out-of-memory termination, or causes denial of service. Authentication to the viaduct endpoint is required; unauthenticated remote exploitation is not possible. The fix introduces a 32 MiB maximum payload size and rejects oversized lengths before memory allocation.

## Affected products

- KubeEdge CloudHub before v1.21.2, v1.22.2, v1.23.1

## Identifiers

- CVE-2026-62370
- GHSA-gfw4-49f9-cp25
- GO-2026-6569

## Timeline

- 2026-09-22: disclosed: GHSA-gfw4-49f9-cp25 published
- 2026-09-22: patched: Patches prepared for v1.23.1, v1.22.2, v1.21.2

## Related threats

- [KubeEdge keadm path traversal in DecompressTarGz](https://junglewise.ai/threats/cve-2026-62369-kubeedge-keadm-path-traversal-in-decompresstargz)
- [KubeEdge ConfigUpdateJob command injection in updateFields](https://junglewise.ai/threats/cve-2026-62182-kubeedge-configupdatejob-command-injection-in-updatefields)
- [KubeEdge command injection in NodeUpgradeJob via v1alpha2 API](https://junglewise.ai/threats/cve-2026-62371-kubeedge-command-injection-in-nodeupgradejob-via-v1alpha2-api)
- [GO-2022-0511 - KubeEdge Cloud Stream and Edge Stream DoS from large stream message in github.com/kubeedge/kubeedge](https://junglewise.ai/threats/cve-2022-31079-kubeedge-cloud-stream-and-edge-stream-dos-from-large-stream)
- [GO-2022-0508 - KubeEdge Cloud AdmissionController component DoS in github.com/kubeedge/kubeedge](https://junglewise.ai/threats/cve-2022-31074-kubeedge-cloud-admissioncontroller-component-dos)