CVE-2026-33022 is a denial of service flaw in Tekton Pipelines, part of Red Hat OpenShift Pipelines. When a user specifies a custom resolver name of 31 or more characters in .spec.taskRef.resolver or .spec.pipelineRef.resolver, the controller generates a resource name exceeding the 63-character DNS-1123 label limit. The truncation logic panics due to an invalid slice operation, causing the controller to crash and enter a CrashLoopBackOff state. This crash affects the entire cluster's CI/CD reconciliation until the problematic resource is deleted. Built-in resolvers with short names are unaffected. The underlying cause is improper handling of length parameters (CWE-130) and path traversal issues (CWE-22). The fix involves truncating the resolver-name prefix rather than the full string to preserve uniqueness, but Red Hat has not yet released a patch.

The vulnerability causes a cluster-wide denial of service by crashing the Tekton Pipelines controller when processing TaskRun or PipelineRun resources with long custom resolver names. This blocks all CI/CD pipeline reconciliation, potentially halting automated deployment workflows until manual intervention removes the offending resource. There is no impact on confidentiality or integrity, but availability is severely affected.

Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, applicability, or stability. The only current mitigation is to manually delete the offending TaskRun or PipelineRun resource causing the crash. Users should avoid creating TaskRun or PipelineRun resources with custom resolver names longer than 30 characters. Monitor Red Hat advisories for future patches.