The vulnerability arises from the use of textproto.Reader.ReadLine() in KubeVirt's downward metrics virtio-serial server, which buffers input indefinitely until a newline character is received, without imposing any length limit or read deadline. A user with access to a VM guest configured with the downward metrics virtio-serial device can exploit this by sending a continuous stream of bytes, causing the virt-handler process to allocate memory without bounds until it is killed by the operating system's OOM killer. This impacts the availability of the virtualization service within Red Hat OpenShift Virtualization 4.

The vulnerability leads to a denial of service by exhausting memory resources of the virt-handler process, causing it to be terminated by the system. There is no impact on confidentiality or integrity. The CVSS v3.1 score is 3.8 (low severity), reflecting the limited scope and impact restricted to availability.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-13322 for current remediation guidance. No official fix or workaround is explicitly stated in the provided advisory content. Users should monitor the vendor advisory for updates and apply any forthcoming patches or mitigations as recommended by Red Hat.