CVE-2026-13322

Name of the Vulnerable Software and Affected Versions KubeVirt (affected versions not specified)

Description A flaw exists in the downward metrics virtio-serial server. The server utilizes the textproto.Reader.ReadLine() function to read guest requests, which buffers input indefinitely until a newline character is encountered, lacking both a length limit and a read deadline. An attacker with access to a VM guest configured with the downward metrics virtio-serial device can send a continuous byte stream to the device. This results in unbounded memory allocation within the virt-handler process, leading to an Out-Of-Memory (OOM) condition that kills the process and causes a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.