{"id":"EUVD-2026-113219","revision":null,"records":[{"revision":"7f5238a139b64905860914d682d5a6ea","observedAt":"2026-10-29T21:48:56.968+00:00","statement":{"source":"cve-program","id":"CVE-2026-118761","aliases":[],"title":"Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory","description":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.","state":0,"publishedAt":"2026-10-29T16:37:44.333+00:00","modifiedAt":"2026-10-29T20:18:59.625+00:00","affected":[{"ecosystem":"Vendor product","name":"pipelines","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"kubeflow\",\n                    \"product\": \"pipelines\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.18.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924","https://github.com/kubeflow/pipelines/pull/14171","https://github.com/kubeflow/pipelines/pull/14186","https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953","https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5","https://github.com/kubeflow/pipelines/releases/tag/2.18.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118761","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-118761","identifiers":["CVE-2026-118761"]},"retained":false,"historicalAffected":[]},{"revision":"173262d4262f46e78d9cddde4135fc72","observedAt":"2026-11-06T01:44:23.915+00:00","statement":{"source":"euvd","id":"EUVD-2026-113219","aliases":["CVE-2026-118761","GHSA-8fmv-6rg5-5924"],"title":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading …","description":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924","https://github.com/kubeflow/pipelines/pull/14171","https://github.com/kubeflow/pipelines/pull/14186","https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953","https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5","https://github.com/kubeflow/pipelines/releases/tag/2.18.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113219","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 29, 2026, 4:37:44 PM","dateUpdated":"Oct 29, 2026, 8:18:59 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-113219","identifiers":["EUVD-2026-113219","CVE-2026-118761","GHSA-8fmv-6rg5-5924"]},"retained":false,"historicalAffected":[]},{"revision":"59387c492cb4417181a31d48bb234fbc","observedAt":"2026-10-30T23:47:40.018+00:00","statement":{"source":"nvd","id":"CVE-2026-118761","aliases":[],"title":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading …","description":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.","state":0,"publishedAt":"2026-10-29T17:18:06.907+00:00","modifiedAt":"2026-10-30T17:18:03.88+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953","https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5","https://github.com/kubeflow/pipelines/pull/14171","https://github.com/kubeflow/pipelines/pull/14186","https://github.com/kubeflow/pipelines/releases/tag/2.18.0","https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-118761","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-409"],"productCriteria":[],"sourceDates":{"published":"2026-10-29T17:18:06.907","lastModified":"2026-10-30T17:18:03.880"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-118761","identifiers":["CVE-2026-118761"]},"retained":false,"historicalAffected":[]},{"revision":"c50db3bbdf5a451da133c9ce1104cc37","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GHSA-8fmv-6rg5-5924","aliases":["CVE-2026-118761","GO-2026-6899"],"title":"Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory","description":"## Summary\n\nThe Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file, potentially exhausting API-server resources and interrupting service.\n\nMultipart pipeline and pipeline-version upload processing decompresses the archive before namespace authorization, so a caller who can reach those endpoints does not need a successful pipeline-create authorization decision to trigger the issue. External authentication and network controls can restrict reachability. URL-import handlers authorize before fetching and decompressing a remote archive.\n\nThe amount of expansion needed to exhaust memory depends on deployment resource limits and concurrent activity; no particular archive is guaranteed to crash every deployment.\n\n## Remediation\n\nUpgrade the API server to **[Kubeflow Pipelines 2.18.0](https://github.com/kubeflow/pipelines/releases/tag/2.18.0)**. Versions through 2.17.3 are affected; the first affected release has not been established.\n\n[PR #14171](https://github.com/kubeflow/pipelines/pull/14171) bounds compressed input and extracted pipeline data. [PR #14186](https://github.com/kubeflow/pipelines/pull/14186) strengthens the total tar traversal budget, including metadata and skipped entries. The 2.18 release also includes configurable upload and specification limits; operators should review the shipped settings and resource budget. These controls address pipeline archive amplification and do not establish general HTTP-body, temporary-disk, concurrency, or CPU limits.\n\nUntil upgrading, restrict access to upload and import endpoints and apply deployment-level request and resource controls. A compressed upload-size limit alone does not prevent decompression amplification. Regression tests cover compressed input, selected-entry boundaries, and tar traversal budgets; no deployed-server OOM test was performed for this assessment.\n\n## Credit\n\n[bugbunny.ai](https://bugbunny.ai) discovered and reported the issue. Ayush Gupta ([@Ayush-kathil](https://github.com/Ayush-kathil)) authored the archive fixes in #14171 and #14186, with Jeff Spahr ([@jeffspahr](https://github.com/jeffspahr)) contributing regression coverage to #14171.\n\n[@BrianWillows](https://github.com/BrianWillows) later submitted a mixed report that included source analysis of pipeline-archive decompression.","state":0,"publishedAt":"2026-10-30T23:13:38+00:00","modifiedAt":"2026-11-05T23:26:17.8872663+00:00","affected":[{"ecosystem":"Go","name":"github.com/kubeflow/pipelines","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260831164314-ba9ae72cc860"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/kubeflow/pipelines","ranges":[],"versions":["1.7.0-alpha.3"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924","https://nvd.nist.gov/vuln/detail/CVE-2026-118761","https://github.com/kubeflow/pipelines/pull/14171","https://github.com/kubeflow/pipelines/pull/14186","https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953","https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5","https://github.com/kubeflow/pipelines","https://github.com/kubeflow/pipelines/releases/tag/2.18.0"],"sourceUrl":"https://github.com/advisories/GHSA-8fmv-6rg5-5924","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8fmv-6rg5-5924","identifiers":["GHSA-8fmv-6rg5-5924","CVE-2026-118761","GO-2026-6899"]},"retained":false,"historicalAffected":[]},{"revision":"3a656e3ebc904b82a955123a21e5c403","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6899","aliases":["CVE-2026-118761","GHSA-8fmv-6rg5-5924"],"title":"Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory in github.com/kubeflow/pipelines","description":"Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory in github.com/kubeflow/pipelines","state":0,"publishedAt":"2026-11-05T22:54:57+00:00","modifiedAt":"2026-11-05T23:15:15.7577126+00:00","affected":[{"ecosystem":"Go","name":"github.com/kubeflow/pipelines","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260831164314-ba9ae72cc860"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924","https://nvd.nist.gov/vuln/detail/CVE-2026-118761","https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953","https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5","https://github.com/kubeflow/pipelines/pull/14171","https://github.com/kubeflow/pipelines/pull/14186","https://github.com/kubeflow/pipelines/releases/tag/2.18.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6899","license":"OSV · upstream source license applies","key":"osv:GO-2026-6899","identifiers":["GO-2026-6899","CVE-2026-118761","GHSA-8fmv-6rg5-5924"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T04:26:54.6034598+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T04:26:54.6034598+00:00","lastSuccessAt":"2026-11-07T04:26:54.7529863+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.7529874+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-f2cb380904b5f12493f409ae3c6d6c9a507fe9d31e15cd21f0d0b573e613fef1","complete":true,"records":420500,"lastAttemptAt":"2026-11-07T04:26:54.1988994+00:00","lastSuccessAt":"2026-11-07T03:26:58.5714293+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.1988994+00:00","snapshotPublishedAt":"2026-11-07T03:24:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-715c0f3771e44acaadcabfd22fd19b53","complete":true,"records":13630,"lastAttemptAt":"2026-11-07T04:38:26.5467121+00:00","lastSuccessAt":"2026-11-07T04:38:26.542+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:38:26.542+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T04:26:54.6034598+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T04:26:54.6034598+00:00","lastSuccessAt":"2026-11-07T04:26:54.7537548+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.7537551+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-34343b4ea57e47c5a482c8fcf20a381e","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T04:26:55.2642231+00:00","lastSuccessAt":"2026-11-07T01:26:55.938+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:55.938+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T04:26:54.5521252+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.5521252+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T04:26:54.3450753+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.3450753+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T04:26:54.565066+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.565066+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-a0b728bc1c5526b5429930c00621636eba8655069c176697c3080f8377619ad7","complete":true,"records":231291,"lastAttemptAt":"2026-11-07T04:26:54.4507985+00:00","lastSuccessAt":"2026-11-07T00:28:51.1983528+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.4507985+00:00","snapshotPublishedAt":"2026-11-06T23:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}