CVE-2026-62370: KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KubeEdge/CloudHub viaduct packer (pkg/viaduct/pkg/packer Reader.Read)to a version that resolves this vulnerability.Fixed in 1.21.2 - Upgrade
Upgrade
KubeEdge/CloudHub viaduct packer (pkg/viaduct/pkg/packer Reader.Read)to a version that resolves this vulnerability.Fixed in 1.22.2 - Upgrade
Upgrade
KubeEdge/CloudHub viaduct packer (pkg/viaduct/pkg/packer Reader.Read)to a version that resolves this vulnerability.Fixed in 1.23.1
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
KubeEdge deployments using versions from 1.0.0 up to, but not including, 1.21.2, 1.22.2, and 1.23.1 are affected where CloudHub processes viaduct messages from edge peers.
What access does an attacker need to trigger the issue?
An attacker must be an authenticated edge peer, or must have compromised one. They can repeatedly send crafted message headers that declare excessive payload lengths to exhaust CloudHub memory.
What is the operational impact?
Successful exploitation can exhaust memory and cause the CloudHub process to terminate or enter restart loops, temporarily disrupting communication between cloud and edge components. The issue does not grant unauthenticated access or direct code execution.
How can the issue be remediated?
Upgrade to KubeEdge 1.21.2, 1.22.2, or 1.23.1, as applicable to the release line in use.