6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44247

CVE-2026-44247: Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body size

Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook server exposed to in-cluster traffic are affected. This vulnerability is fixed in v1.14.2, v1.13.3, and v1.12.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44247

CVE-2026-44247:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
volcano.sh/volcano	go	< 1.12.4	1.12.4
volcano.sh/volcano	go	>= 1.13.0, < 1.13.3	1.13.3
volcano.sh/volcano	go	>= 1.14.0, < 1.14.2	1.14.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-8wxp-xxp2-rcgx, is an uncontrolled resource consumption flaw in the Volcano webhook server. The server did not enforce a size limit on incoming HTTP request bodies, making it susceptible to a denial-of-service attack. An in-cluster user with access to the webhook endpoint could send a request with an extremely large body, causing the webhook server to allocate an excessive amount of memory, eventually leading to an Out-of-Memory (OOM) kill.

The analysis of the patch commits reveals that the core of the vulnerability was in the Serve function located in pkg/webhooks/router/server.go. This function used io.ReadAll(r.Body) to read the request body without any restrictions. The fix, introduced in commit 485e0670d68fc1d53a85b2a5a4f8c4eb5c6a2cdd, involves wrapping the request body with http.MaxBytesReader. This effectively caps the amount of data that can be read from the request body, preventing the OOM condition.

The primary vulnerable function identified is router.Serve. Additionally, the anonymous handler function within router.RegisterAdmission is also flagged as it is the entry point for the request and directly calls the vulnerable function. During an exploit, both of these functions would likely appear in a runtime profile or stack trace.

Vulnerable functions

router.Serve

pkg/webhooks/router/server.go

The function `Serve` (renamed to `serve` in the patch) is responsible for handling incoming HTTP requests to the webhook server. The vulnerability lies in the fact that it reads the entire request body into memory using `io.ReadAll(r.Body)` without any size limit. This allows an attacker to send a request with an arbitrarily large body, causing the server to consume excessive memory, which can lead to an Out-of-Memory (OOM) kill and a denial of service. The patch fixes this by using `http.MaxBytesReader` to enforce a limit on the request body size.

router.RegisterAdmission.func1

pkg/webhooks/router/admission.go

This anonymous function within `RegisterAdmission` acts as the HTTP handler for the admission webhook. It directly calls the vulnerable `Serve` function. When the vulnerability is triggered, this handler would be on the call stack, making it a relevant runtime indicator. The patch changes the call from the vulnerable `Serve` to the fixed `serve` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.