{"id":"EUVD-2026-39599","enisaUuid":"9c02759e-6a2b-31fe-903f-3ffd263bfdbf","description":"A flaw was found in KubeVirt\u0027s downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.","datePublished":"Jun 26, 2026, 12:04:07 AM","dateUpdated":"Jun 26, 2026, 1:39:15 PM","baseScore":3.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","references":"https://access.redhat.com/security/cve/CVE-2026-13322\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2492681\n","aliases":"CVE-2026-13322\nGHSA-6f2p-2qg2-qqch\n","assigner":"redhat","epss":0.13,"enisaIdProduct":[],"enisaIdVendor":[],"enisaIdVulnerability":[{"id":"4224a2ad-b2e5-3a41-ac4d-abf83abb3922","vulnerability":{"id":"CVE-2026-13322","description":"A flaw was found in KubeVirt\u0027s downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.","datePublished":"Jun 26, 2026, 12:04:07 AM","dateUpdated":"Jun 26, 2026, 1:39:15 PM","status":"PUBLISHED","baseScore":3.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","references":"https://access.redhat.com/security/cve/CVE-2026-13322\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2492681\n","enisa_id":"EUVD-2026-39599\n","assigner":"redhat","epss":0.13,"dataProcessed":"Nov 4, 2026, 7:16:52 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c162de3a-28d8-3f3a-9986-ce4f8265d375","vulnerability":{"id":"GHSA-6f2p-2qg2-qqch","description":"KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption","datePublished":"Jun 26, 2026, 12:32:07 AM","dateUpdated":"Nov 4, 2026, 5:16:06 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-13322\nhttps://access.redhat.com/security/cve/CVE-2026-13322\nhttps://bugzilla.redhat.com/show_bug.cgi?id\u003d2492681\nhttps://github.com/kubevirt/kubevirt\nhttps://github.com/kubevirt/kubevirt/blob/e63503d2f3a166f79f0891f8e1c3450eb39f88ac/pkg/downwardmetrics/virtio-serial/server.go#L240-L251\n","enisa_id":"EUVD-2026-39599\n","aliases":"CVE-2026-13322\nGHSA-6f2p-2qg2-qqch\n","epss":0.0,"dataProcessed":"Nov 4, 2026, 8:00:50 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"cd2f050b-d2b4-367e-8a20-fdfe2d7b8cf4","advisory":{"id":"msrc_CVE-2026-13322","description":"Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service","datePublished":"Jul 1, 2026, 1:02:40 AM","dateUpdated":"Oct 31, 2026, 1:01:54 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-13322.json\n","aliases":"CVE-2026-13322\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"36005799-6c94-3980-aba6-77f104d147c0","product":{"name":"azl3 kubevirt-openvmm 0:1.9.0-1.azl3","vendor":{"name":"Microsoft"}}},{"id":"5d8a8d88-5bd1-3ead-946d-474966c1b652","product":{"name":"kubevirt","vendor":{"name":"KubeVirt"}}},{"id":"87574edd-07ac-312b-86cd-428c75f6a6b7","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"fba70c60-89fa-3f90-bc63-2b2c5dae7406","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}}]}}]}