CVE-2026-33022 is a denial of service vulnerability in Tekton Pipelines, a component of Red Hat OpenShift Pipelines Operator. The issue arises when a TaskRun or PipelineRun resource is created with a .spec.taskRef.resolver or .spec.pipelineRef.resolver string of 31 or more characters. The controller attempts to generate a deterministic name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics due to an invalid slice bound. This causes the controller to crash and enter a CrashLoopBackOff, blocking all CI/CD pipeline reconciliation cluster-wide until the problematic resource is deleted. Built-in resolvers with short names are unaffected, but any custom resolver name triggers the bug. The upstream fix truncates the resolver-name prefix instead of the full string to preserve uniqueness and prevent the panic. Red Hat has not yet released a fix for this issue in OpenShift Pipelines 1.20.4.

The vulnerability causes a denial of service by crashing the Tekton Pipelines controller in Red Hat OpenShift Pipelines. This results in a cluster-wide disruption of CI/CD pipeline reconciliation, effectively halting automated deployment workflows until manual intervention removes the offending resource. There is no impact on confidentiality or integrity, but availability is severely affected.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, deployment, and stability. The only mitigation is manual deletion of the offending TaskRun or PipelineRun resource with a long custom resolver name to restore controller functionality. Users should avoid creating TaskRun or PipelineRun resources with custom resolver names of 31 or more characters until a fix is released. Monitor Red Hat advisories for updates.