Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

knative.dev/pkg

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5GoAmendedPublished

    knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion

    CVE-2026-54462 · GHSA-2hw4-c9m4-f2fj

    Affected
    • Go knative.dev/pkg < 0.0.0-20260531000007-52dbd5ece63f
    Fixed in
    0.0.0-20260531000007-52dbd5ece63f· Vendor fix available
    Issue
    ⚠️ Update (verification, 2026-05-19): C-2 confirmed end-to-end — 4.5× amplification observed (worse than the advisory's conservative 2× claim) Built a Go PoC (`cmd/poc-c2/main.go`) that runs the exact 8-line vulnerable snippet from `webhook/admission.go:109-117` verbatim under the same `http.HandlerFunc` shape (the full production `admissionHandler` at `:85` requires `*Webhook` + `AdmissionController` + an informer-synced channel + controller-runtime / client-go scaffolding — the bug is the missing `http.MaxBytesReader`, nothing else in the handler). Bound to `127.0.0.1:18098`. PoC client streamed 2 GiB of `a` bytes over a raw TCP socket. `runtime.MemStats.HeapAlloc` sampler: ``` baseline: HeapAlloc = 0.32 MiB peak: HeapAlloc = 9 217.38 MiB = 9.00 GiB ratio: 4.50× the…

    Recommended action: Upgrade to 0.0.0-20260531000007-52dbd5ece63f (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →