CVE-2026-54462: Unbounded Request-Body Memory Exhaustion in Knative Admission Webhooks

Vulnerability ID: GHSA-2HW4-C9M4-F2FJ

CVSS Score: 6.5

Published: 2026-10-28

An uncontrolled resource consumption vulnerability in the knative.dev/pkg/webhook package allows network-adjacent attackers within a Kubernetes cluster to trigger Out-Of-Memory (OOM) terminations of admission controller pods. The admission webhook HTTP server processes incoming AdmissionReview requests through an io.TeeReader and json.Decoder pipeline without enforcing an upper bound on request body size. Due to internal buffer reallocation mechanics, incoming payloads experience a 4.5x memory amplification factor.…