CVE-2026-13322: Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service
A flaw was found in KubeVirt's downward metrics virtio-serial server in virt-handler. The server reads guest requests using textproto.Reader.ReadLine() in pkg/downwardmetrics/virtio-serial/server.go, which buffers input indefinitely until a newline character is received, with no length limit or read deadline. The server is started from dmetrics-manager.go and wired into the virt-handler process at cmd/virt-handler/virt-handler.go — it runs inside virt-handler's address space, not in the per-VM virt-launcher pod. A VM guest writing a continuous byte stream without newlines to the downward-metrics virtio-serial channel causes unbounded heap allocation in virt-handler until it is OOM-killed. Affected image: virt-handler-rhel9. Upstream fix should wrap the reader in io.LimitedReader with a small cap and add a per-read deadline.
Other sources
A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply a compensating control by preventing untrusted/guest users from writing to the downward-metrics virtio-serial device (e.g., restrict VM guest access/tenancy or remove/disable the downward-metrics virtio-serial device for guests that do not require it), since the virtio-serial server in virt-handler buffers without a newline/size limit.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13322?
CVE-2026-13322 has a low severity rating of 3.8.
How do I fix CVE-2026-13322?
To mitigate CVE-2026-13322, limit the input size for the virtio-serial readline within the virt-handler.
What software is affected by CVE-2026-13322?
CVE-2026-13322 affects KubeVirt and specifically the virt-handler component on rhel9.
What is the risk associated with CVE-2026-13322?
CVE-2026-13322 poses a risk of an out-of-memory denial of service due to unbounded input buffering.
What causes the vulnerability in CVE-2026-13322?
The vulnerability in CVE-2026-13322 is caused by the virtio-serial server reading input without a length limit, allowing indefinite buffering.