Threats tagged 'ghsa-6f2p-2qg2-qqch'

CVE-2026-13322 is a vulnerability in KubeVirt's downward metrics virtio-serial server where the server reads guest requests without length limits or read deadlines, allowing a VM guest user to cause unbounded memory allocation in the virt-handler process. This can lead to the virt-handler being OOM-killed, disrupting management operations on the affected node. The vulnerability requires explicit configuration of the downward metrics virtio-serial device and is limited in scope to the node running the affected virt-handler pod. The impact is low as running VM workloads continue unaffected and recovery is possible by deleting the offending VirtualMachineInstance.