The knative.dev/pkg admission webhook handler lacks an upper bound on the HTTP request body size, leading to unbounded memory consumption. This causes the controller pod to exhaust memory and be OOM-killed when processing large POST requests. The vulnerability affects all projects using this webhook scaffolding, including Knative serving/eventing, Tekton Pipelines/Triggers, KEDA, Sigstore policy-controller, and Kpack. The peak memory usage can be approximately 4.5 times the request body size due to internal buffering and copying. This issue is confirmed in the main branch and all releases shipping the vulnerable handler code. A fix is available in version 0.0.0-20260531000007-52dbd5ece63f.