Threats tagged 'ghsa-8fmv-6rg5-5924'

Kubeflow Pipelines API server versions through 2.17.3 decompress uploaded pipeline archives without sufficient limits on expanded data size. This allows a crafted compressed archive (ZIP or gzip tar) to consume excessive memory during decompression, potentially exhausting server resources and causing service interruption. The vulnerability can be triggered by unauthenticated callers who can reach the upload endpoints, as decompression occurs before authorization. The issue is fixed in version 2.18.0, which introduces bounds on compressed input and extracted data sizes.