CVE-2026-13322
Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service
Description
A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.
INFO
Published Date :
June 26, 2026, 12:04 a.m.
Last Modified :
June 26, 2026, 12:04 a.m.
Remotely Exploit :
No
Source :
redhat
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | LOW | 53f830b8-0a3f-465b-8143-3b8a9948e749 |
Solution
- Apply patches to KubeVirt to limit buffer sizes.
- Implement read deadlines for virtio-serial input.
- Monitor virt-handler memory usage.
- Restart affected virt-handler processes.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-13322 vulnerability anywhere in the article.