Description

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-21T17:17:36.957Z",
  "pubdate": "2026-09-21T17:17:36.957Z",
  "executiveSummary": "KubeEdge is susceptible to a memory exhaustion vulnerability within its viaduct message-processing component. The flaw originates from an improper validation of the 'PayloadLen' field in the 'PackageHeader' during the execution of 'Reader.Read' located in 'pkg/viaduct/pkg/packer'. By sending crafted headers with excessively high payload length declarations, an authenticated malicious edge peer can trigger immediate memory allocation requests that exceed available system resources. This exploitation path forces the CloudHub process to crash, leading to service disruption through process termination or persistent restart loops. The vulnerability impacts KubeEdge versions 1.0.0 through 1.21.2, 1.22.2, and 1.23.1. While this issue does not facilitate remote code execution or bypass authentication mechanisms, it represents a significant availability risk, as an authenticated attacker can effectively sever the cloud-edge communication tunnel, causing systemic degradation of the edge orchestration environment. Remediation requires updating to the patched versions where input validation bounds have been implemented to ensure memory allocation requests remain within safe, predefined limits.",
  "technicalDetails": "The vulnerability resides in the 'Reader.Read' function within 'pkg/viaduct/pkg/packer', which handles incoming network traffic for the CloudHub component. The root cause is a failure to perform adequate input validation on the 32-bit 'PackageHeader.PayloadLen' field before initiating memory allocation. In the current implementation, the application treats the declared length in the incoming message header as a trusted input. When the 'Reader.Read' function processes a viaduct message, it immediately allocates a memory buffer commensurate with the 'PayloadLen' value specified in the header to accommodate the incoming payload.\nBecause there is no upper-bound validation or sanity check applied to this 32-bit field, a malicious or compromised edge peer can deliberately transmit a crafted header containing a 'PayloadLen' value set to a value near the maximum capacity of a 32-bit integer. When the CloudHub process receives such a header, it attempts to allocate a contiguous block of memory equal to that declared length. This behavior causes an out-of-memory (OOM) condition, forcing the host operating system to either invoke the OOM killer or cause the process to crash due to heap exhaustion.\nThe attack flow proceeds as follows: First, the attacker must establish an authenticated session as an edge peer, which is a prerequisite for interacting with the CloudHub service. Once authenticated, the attacker constructs a malicious viaduct protocol packet with a modified 'PackageHeader'. Specifically, the 'PayloadLen' field is manipulated to represent an extremely large buffer size. The attacker transmits this packet to the CloudHub endpoint. Upon receipt, the 'Reader.Read' function executes the allocation logic without verifying if the requested memory is reasonably sized or within the established constraints of the system's memory architecture. The immediate impact is the exhaustion of available system memory, leading to the termination of the CloudHub process. By repeating this process, an attacker can induce a restart loop, rendering the cloud-to-edge communication channel non-functional. This vulnerability is restricted to authenticated edge peers and does not grant the attacker unauthorized system access, code execution privileges, or the ability to bypass the existing authentication framework. However, the resulting denial-of-service capability effectively disrupts the orchestration capabilities that KubeEdge provides to edge nodes, isolating them from the central control plane."
}