6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40924

CVE-2026-40924: Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Prior to 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http implementations. This vulnerability is fixed in 1.11.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40924

CVE-2026-40924:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/tektoncd/pipeline	go	<= 1.11.0	1.11.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the FetchHttpResource function located in pkg/resolution/resolver/http/resolver.go. This function is responsible for fetching resources over HTTP for Tekton Pipelines. The core of the vulnerability is the use of io.ReadAll(resp.Body) without any limit on the size of the response body. This allows a malicious actor, with permissions to create TaskRuns or PipelineRuns, to specify a URL to a server they control. This server can then send an extremely large HTTP response. The Tekton resolver, upon receiving this response, attempts to read the entire body into memory, leading to excessive memory allocation. If the allocated memory exceeds the container's limit, Kubernetes will terminate the pod with an Out-of-Memory (OOM) error, causing a denial of service for all resolution services in the cluster. The fix, as seen in commit db61c71c6f4584e8b06e52d23b99b29d0bb078d5, introduces an io.LimitedReader to cap the number of bytes read from the response body, effectively mitigating the OOM threat.

Vulnerable functions

FetchHttpResource

pkg/resolution/resolver/http/resolver.go

The function `FetchHttpResource` reads the entire body of an HTTP response into memory using `io.ReadAll` without any size restrictions. An attacker can exploit this by providing a URL to a malicious server that returns a very large response body, causing the resolver to consume excessive memory, leading to a denial-of-service (DoS) through an Out-of-Memory (OOM) kill.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.