CVE-2026-62370
Received Received - Intake

Memory Exhaustion in KubeEdge via Malicious Headers

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-62370
EUVD
EUVD-2026-84004

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
kubeedge kubeedge 1.0.0
kubeedge kubeedge 1.21.2
kubeedge kubeedge 1.22.2
kubeedge kubeedge 1.23.1
kubeedge kubeedge From 1.0.0 (inc) to 1.21.2 (exc)
kubeedge kubeedge From 1.22.0 (inc) to 1.22.2 (exc)
kubeedge kubeedge From 1.23.0 (inc) to 1.23.1 (exc)
kubeedge kubeedge to 1.21.2 (inc)
kubeedge kubeedge to 1.22.2 (inc)
kubeedge kubeedge to 1.23.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in KubeEdge allows an authenticated malicious or compromised edge peer to send crafted messages with excessively large declared payload lengths. The system allocates memory based on these lengths without validating an upper bound, causing memory exhaustion, process termination, or restart loops in the CloudHub component. This disrupts cloud-edge communication but does not provide unauthenticated access or direct code execution.

Detection Guidance

Monitor CloudHub process memory usage and logs for repeated crashes or restarts. Check for unusually large payloads in viaduct messages using packet inspection tools like tcpdump or Wireshark. Look for errors in CloudHub logs indicating payload length violations or memory exhaustion.

Impact Analysis

An attacker could exploit this to cause denial-of-service by crashing or repeatedly restarting the CloudHub process, temporarily halting cloud-edge communication. This may disrupt operations relying on edge nodes, especially in environments where uptime is critical. The impact is limited to service disruption rather than data breaches or unauthorized access.

Compliance Impact

This vulnerability primarily impacts availability rather than confidentiality or integrity. While it may not directly violate GDPR or HIPAA, repeated service disruptions could lead to non-compliance with availability requirements. Organizations must ensure robust monitoring and mitigation to maintain service continuity and meet regulatory standards.

Mitigation Strategies
  • Upgrade KubeEdge to versions 1.21.2, 1.22.2, or 1.23.1 or later to apply the payload size limit fix.
  • Restrict network access to CloudHub to trusted edge nodes only.
  • Apply memory limits to the CloudHub process to prevent exhaustion.
  • Monitor CloudHub for abnormal memory usage or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62370. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart