Tekton Pipelines' HTTP resolver component in affected versions calls io.ReadAll on HTTP response bodies without imposing size limits. An attacker who can create TaskRuns or PipelineRuns referencing the HTTP resolver can direct it to an attacker-controlled HTTP server that returns a large response body within the timeout window. This causes excessive memory consumption, leading Kubernetes to OOM-kill the tekton-pipelines-resolvers pod. Since all resolver types run in the same pod, this results in denial of resolution service cluster-wide. The vulnerability affects versions starting from 1.0.0 up to but not including 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, which contain fixes.

Exploitation leads to denial of service by causing the tekton-pipelines-resolvers pod to be terminated due to out-of-memory conditions. This disrupts resolution services for all resolver types in the cluster, potentially causing sustained crash loops if exploited repeatedly. There is no impact on confidentiality or integrity reported.

Fixed versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 address this vulnerability. Users should upgrade to one of these versions or later to remediate the issue. No vendor advisory content is provided to indicate alternative mitigations or temporary fixes. Patch status is not explicitly confirmed beyond the version fixes noted; verify with vendor advisories for current remediation guidance.