CVE-2026-27887
Out-of-Memory Crash in Spin Due to Unbounded Response Buffering
Publication date: 2026-02-26
Last updated on: 2026-02-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fermyon | spin | 3.6.1 |
| fermyon | spinkube | 0.6.2 |
| fermyon | containerd-shim-spin | 0.22.1 |
| fermyon | spin | to 3.6.1 (exc) |
| fermyon | spinkube | to 0.6.2 (exc) |
| fermyon | containerd-shim-spin | to 0.22.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-774 | The product allocates file descriptors or handles on behalf of an actor without imposing any restrictions on how many descriptors can be allocated, in violation of the intended security policy for that actor. |
| CWE-789 | The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. |
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-27887 is a memory leak vulnerability in the Spin Framework and its related components SpinKube and containerd-shim-spin. It occurs when Spin is configured to connect to databases or web servers that can return responses of unbounded size, such as large tables or content bodies. Spin may try to buffer the entire response on the host side before delivering it to the guest application, which can cause excessive memory allocation on the host.
This excessive memory usage can lead to the host process running out of memory, panicking, and crashing. A malicious guest application can exploit this by inserting large amounts of data incrementally into a database and then retrieving all of it in a single query, causing large memory allocations on the host and potentially triggering a denial-of-service (DoS) condition.
The vulnerability affects various APIs that buffer data on the host, including spin:sqlite, spin:postgres, fermyon:spin/mysql, fermyon:spin/postgres, fermyon:spin/sqlite, fermyon:spin/key-value, fermyon:spin/llm, fermyon:spin/http, fermyon:spin/redis, and wasi:keyvalue.
How can this vulnerability impact me? :
This vulnerability can impact you by causing the host process running Spin to consume excessive memory and crash, leading to a denial-of-service (DoS) condition. This means that applications relying on Spin for serverless WebAssembly execution may become unavailable or unstable.
An attacker with low privileges and partial user interaction can exploit this by causing large memory allocations through unbounded database or web server responses, potentially disrupting service availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves Spin attempting to buffer entire responses from databases or web servers that can return unbounded size data, which may lead to host process crashes due to out-of-memory conditions.'}, {'type': 'paragraph', 'content': 'Detection can focus on monitoring Spin host processes for abnormal memory usage or crashes, especially when interacting with databases or HTTP servers that return large responses.'}, {'type': 'paragraph', 'content': 'Specific commands are not provided in the available resources, but general approaches include:'}, {'type': 'list_item', 'content': "Monitoring Spin process memory usage with tools like 'top', 'htop', or 'ps' to detect unusually high memory consumption."}, {'type': 'list_item', 'content': 'Checking system logs or Spin logs for crash reports or panic messages indicating out-of-memory errors.'}, {'type': 'list_item', 'content': 'Using network monitoring tools to identify large or unbounded responses from databases or HTTP servers accessed by Spin.'}, {'type': 'list_item', 'content': 'Auditing guest applications for queries or requests that retrieve large datasets or insert large amounts of data incrementally.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating Spin and related components to the patched versions:
- Upgrade Spin to version 3.6.1 or later.
- Upgrade SpinKube to version 0.6.2 or later.
- Upgrade containerd-shim-spin to version 0.22.1 or later.
Additionally, configure Spin to restrict access only to trusted databases and HTTP servers that enforce response size limits to prevent unbounded memory consumption.