{"id":"CVE-2026-13322","sourceIdentifier":"secalert@redhat.com","published":"2026-06-26T00:16:51.397","lastModified":"2026-10-25T22:10:00.150","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed."},{"lang":"es","value":"Se encontró un fallo en el servidor virtio-serial de métricas descendentes de KubeVirt. El servidor lee las solicitudes del invitado usando textproto.Reader.ReadLine(), que almacena en búfer la entrada de forma indefinida hasta que se recibe un carácter de nueva línea, sin límite de longitud ni plazo de lectura. Un usuario con acceso a un invitado de VM que tiene configurado el dispositivo virtio-serial de métricas descendentes puede escribir un flujo continuo de bytes en el dispositivo, causando una asignación de memoria ilimitada en el proceso virt-gestor hasta que es eliminado por OOM."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat OpenShift Virtualization 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"container-native-virtualization/virt-handler","cpes":["cpe:/a:redhat:container_native_virtualization:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Virtualization 4","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"container-native-virtualization/virt-handler-rhel9","cpes":["cpe:/a:redhat:container_native_virtualization:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","baseScore":3.8,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.0,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-26T13:39:04.943661Z","id":"CVE-2026-13322","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:*","versionStartIncluding":"4","versionEndIncluding":"4.22.0","matchCriteriaId":"5301905C-9B5C-479F-A69A-659C6CB3AA42"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:kubevirt:kubevirt:-:*:*:*:*:kubernetes:*:*","matchCriteriaId":"06AF9668-6158-47F4-A755-0EE4D5F7F413"}]}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-13322","source":"secalert@redhat.com","tags":["Mitigation","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492681","source":"secalert@redhat.com","tags":["Issue Tracking","Vendor Advisory"]}]}