fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

• CVE-2023-27483: 0.80% estimated exploitation activity in the next 30 days; percentile 56.57 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary Fuzz testing on crossplane/crossplane, by Ada Logics and sponsored by the CNCF, identified input to a function in the fieldpath package that can cause an out of memory panic. Applications that use the Paved type's SetValue method with user provided input without proper validation might use excessive amounts of memory and cause an out of memory panic. Details In the fieldpath package, the SetValue method of the Paved type sets a value on the inner object according to the provided path, without validating it first. This allows setting values in slices at any specific index and the code will grow the target array up to the required size. The index is currently capped at max uint32 (4294967295) given how indexes are parsed, but that is still an unnecessarily large value. Workaround Users can parse and validate the path before passing it to the SetValue method of the Paved type, constraining the index size as deemed appropriate. Credits Disclosed by Ada Logics in a fuzzing audit…

Published by the source

13 Mar 2023, 20:53 UTC

Last modified by the source

4 Apr 2023, 21:35 UTC

Source last checked

26 Oct 2026, 14:58 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-vfvj-3m3g-m532

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2023-27483

Advisory: fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime
IDs: CVE-2023-27483, GHSA-vfvj-3m3g-m532
Record: https://patchnext.com/advisories/cve-2023-27483 (revision 1, source checked 26 Oct 2026, 14:58 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.9)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/crossplane/crossplane-runtime 0.19.2, 0.16.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/crossplane/crossplane-runtime: affected >= 0.17.0, < 0.19.2; >= 0.6.0, < 0.16.1; fixed in 0.19.2, 0.16.1

## Suggested inspection (read-only)
- Go github.com/crossplane/crossplane-runtime: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/crossplane/crossplane-runtime.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-vfvj-3m3g-m532 (GitHub-reviewed advisory GHSA-vfvj-3m3g-m532 lists affected ranges: Go github.com/crossplane/crossplane-runtime >=0.17.0 =0.6.0 <0.16.1)

Commands are suggestions: review each one before running it.