CVE-2026-62370

Name of the Vulnerable Software and Affected Versions KubeEdge versions 1.0.0 through 1.21.1 KubeEdge versions 1.22.0 through 1.22.1 KubeEdge versions 1.23.0 through 1.23.0

Description The Reader.Read function in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received via the CloudHub viaduct message-processing path and allocates memory based on this value before validating an upper bound. An authenticated malicious or compromised edge peer can send crafted headers with excessive lengths, leading to memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication.

Recommendations Update to version 1.21.2. Update to version 1.22.2. Update to version 1.23.1.