-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/kubeedge/kubeedge | go | >= 1.11.0, < 1.11.1 | 1.11.1 |
| github.com/kubeedge/kubeedge | go | >= 1.10.0, < 1.10.2 | 1.10.2 |
| github.com/kubeedge/kubeedge | go | < 1.9.4 | 1.9.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from uncontrolled request body processing in Cloud AdmissionController endpoints. The key patch adds request size limits via http.MaxBytesReader in the serve() function that handles admission webhook requests. This function is explicitly called for AdmissionController endpoints mentioned in the CVE description. The unpatched version lacked this size restriction, making it vulnerable to DoS via large payloads. Other modified functions (signEdgeCert, httpHandler) show similar patterns but are either edge-side components or response processors, not the vulnerable AdmissionController request handlers.
Ongoing coverage of React2Shell