Executive brief
Eclipse Ankaios is a container orchestration platform that manages workloads across distributed systems. A workload with access to the Control Interface can trigger excessive memory allocation in the Ankaios agent by declaring an abnormally large message length in a protobuf message, causing the agent process to crash and interrupt orchestration services.
Technical details
The Ankaios agent does not validate the length field declared by a workload in length-delimited protobuf messages received through the Control Interface FIFO. A malicious or misconfigured workload can specify an excessively large message length, triggering unbounded memory allocation that exhausts available memory and terminates the agent process. This is a resource exhaustion / denial-of-service vulnerability affecting the orchestration layer. The attack requires a workload to have Control Interface access, is network-reachable through the FIFO interface, and has been fixed in version 1.0.2 via message size validation checks.
Affected products
- Eclipse Ankaios 0.1.0 through 1.0.1
Timeline
- 2026-09-07: disclosed
- 2026-09-04: patched: Fixed in version 1.0.2