---
id: CVE-2026-13322
aliases:
  - GHSA-6f2p-2qg2-qqch
title: >-
  KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory
  consumption
summary: >-
  KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory
  consumption
severity: low
cvss: 3.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L'
vendor: kubevirt
product: github.com/kubevirt/kubevirt
ecosystem: go
affected:
  - 'github.com/kubevirt/kubevirt >= 1.1.0-alpha.0, <= 1.10.0-rc.0'
published: '2026-06-26'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T17:30:04.822633018Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6f2p-2qg2-qqch'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-13322'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-13322'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2492681'
  - url: 'https://github.com/kubevirt/kubevirt'
  - url: >-
      https://github.com/kubevirt/kubevirt/blob/e63503d2f3a166f79f0891f8e1c3450eb39f88ac/pkg/downwardmetrics/virtio-serial/server.go#L240-L251
  - url: 'https://github.com/advisories/GHSA-6f2p-2qg2-qqch'
tags:
  - osv
  - go
  - ghsa
epss: 0.00134
epssPercentile: 0.02955
cwe:
  - CWE-770
ingestedAt: '2026-11-04T17:19:45.133Z'
---

## Overview

A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.

## Affected packages

- `github.com/kubevirt/kubevirt >= 1.1.0-alpha.0, <= 1.10.0-rc.0`

## Remediation

Refer to the advisory for the patched release.