---
id: CVE-2026-54462
title: >-
  knative.dev/pkg admission webhooks allow unbounded request-body memory
  exhaustion
summary: >-
  Knative pkg provides common packages shared across Knative repositories. Prior
  to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook
  admissionHandler in webhook/admission.go decodes an attacker-supplied
  AdmissionReview throug…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-770
vendor: knative
product: pkg
affected:
  - pkg < 0.0.0-20260531000007-52dbd5ece63f
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T19:28:33.067745Z'
exploitAvailable: true
published: '2026-10-27'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T19:29:02.459Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-54462'
references:
  - url: 'https://github.com/knative/pkg/security/advisories/GHSA-2hw4-c9m4-f2fj'
    label: 'https://github.com/knative/pkg/security/advisories/GHSA-2hw4-c9m4-f2fj'
  - url: 'https://github.com/knative/pkg/pull/3363'
    label: 'https://github.com/knative/pkg/pull/3363'
  - url: >-
      https://github.com/knative/pkg/commit/52dbd5ece63fe6d2d340ecbebec160550f460818
    label: >-
      https://github.com/knative/pkg/commit/52dbd5ece63fe6d2d340ecbebec160550f460818
  - url: 'https://github.com/knative/pkg'
tags:
  - cve.org
  - exploit-available
  - osv
  - go
epss: 0.00376
epssPercentile: 0.31732
aliases:
  - GHSA-2hw4-c9m4-f2fj
ecosystem: go
patched:
  - knative.dev/pkg 0.0.0-20260531000007-52dbd5ece63f
ingestedAt: '2026-10-27T16:32:34.406Z'
---

## Overview

Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoder(io.TeeReader(r.Body, &bodyBuffer)) under an http.HandlerFunc without an http.MaxBytesReader or equivalent body-size limit. A pod-network client can send one oversized POST to an admission webhook, causing the decoder and bodyBuffer to retain amplified copies of the request until the controller pod exhausts memory and is OOM-killed. Every downstream consumer using the shared webhook server inherits the vulnerable behavior, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack. For consumers configured with failurePolicy=Fail, loss of the controller can interrupt admission; with failurePolicy=Ignore, the affected webhook is unavailable while other admissions continue. This issue is fixed in version 0.0.0-20260531000007-52dbd5ece63f.

## Affected

- `pkg < 0.0.0-20260531000007-52dbd5ece63f`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54462)

Affected packages:

- `knative.dev/pkg < 0.0.0-20260531000007-52dbd5ece63f`

Patched in:

- `knative.dev/pkg 0.0.0-20260531000007-52dbd5ece63f`

Source: https://osv.dev/vulnerability/GHSA-2hw4-c9m4-f2fj