GitHub Advisoryadvisory · Go

GHSA-8wxp-xxp2-rcgx Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size

MEDIUM Published 2026-05-08 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-44247
Ecosystem
Go
Packages
volcano.sh/volcano
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-770
Reviewed
2026-05-08

Affected packages

• Go volcano.sh/volcano: < 1.12.4 → fixed in 1.12.4 • Go volcano.sh/volcano: >= 1.13.0, < 1.13.3 → fixed in 1.13.3 • Go volcano.sh/volcano: >= 1.14.0, < 1.14.2 → fixed in 1.14.2

Description

Impact The Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook server exposed to in-cluster traffic are affected. Patches This issue will be fixed in the following versions: • v1.14.2 • v1.13.3 • v1.12.4 Users running versions below these should upgrade accordingly. Workarounds No known workarounds. Upgrade to the patched versions listed above.

Related

Alias · CVE (1)

  • CVE-2026-44247 Volcano is a Kubernetes-native batch scheduling system. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References