Bug 2562245 (CVE-2026-54462)

Summary: CVE-2026-54462 knative.dev/pkg: knative.dev/pkg: Denial of Service via oversized request body
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, anpicker, aos-team-art-private, asdas, bsquizza, cmitchel, dfreiber, dhanak, dkeler, dpaolell, drosa, drow, dsimansk, eborisov, elicohen, gbenhaim, hasun, jburrell, jdelft, jfula, jowilson, jupierce, kingland, lball, lgarciaa, mbiarnes, mnovotny, ngough, niyer, nyancey, ometelka, ppalepu, ppostler, prdhamdh, ptisnovs, sausingh, sdawley, sghai, sidsharm, suppawar, syedriko, thason, twaugh, veshanka, vkumar, vlaad, xdharmai
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in knative.dev/pkg. The admission webhook handler does not enforce size restrictions on incoming HTTP request bodies. A network client can exploit this vulnerability by submitting an oversized request, causing the controller process to exhaust memory and crash. This results in a Denial of Service (DoS) that can disrupt admission review operations across dependent services.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-27 18:22:09 UTC 
Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoder(io.TeeReader(r.Body, &bodyBuffer)) under an http.HandlerFunc without an http.MaxBytesReader or equivalent body-size limit. A pod-network client can send one oversized POST to an admission webhook, causing the decoder and bodyBuffer to retain amplified copies of the request until the controller pod exhausts memory and is OOM-killed. Every downstream consumer using the shared webhook server inherits the vulnerable behavior, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. For consumers configured with failurePolicy=Fail, loss of the controller can interrupt admission; with failurePolicy=Ignore, the affected webhook is unavailable while other admissions continue. This issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f.