Low severity3.8NVD Advisory· Published Jun 26, 2026· Updated Jul 6, 2026
CVE-2026-13322
CVE-2026-13322
Description
A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.
Affected products
4- cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:*Range: >=4,<=4.22.0
Patches
Vulnerability mechanics
References
2- access.redhat.com/security/cve/CVE-2026-13322nvdMitigationVendor Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor Advisory
News mentions
0No linked articles in our index yet.