KubeEdge up to 1.21.1/1.22.1/1.23.0 Viaduct pkg/viaduct/pkg/packer Reader.Read PayloadLen memory allocation

Summaryinfo

A vulnerability labeled as critical has been found in KubeEdge up to 1.21.1/1.22.1/1.23.0. This vulnerability affects the function Reader.Read of the file pkg/viaduct/pkg/packer of the component Viaduct. The manipulation of the argument PayloadLen results in memory allocation. This vulnerability is known as CVE-2026-62370. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in KubeEdge up to 1.21.1/1.22.1/1.23.0. Affected is the function Reader.Read of the file pkg/viaduct/pkg/packer of the component Viaduct. The manipulation of the argument PayloadLen with an unknown input leads to a memory allocation vulnerability. CWE is classifying the issue as CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. This is going to have an impact on availability. CVE summarizes:

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-62370 since 07/14/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available.

Upgrading to version 1.21.2, 1.22.2 or 1.23.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-84004). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• KubeEdge

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.21.0
• 1.21.1
• 1.22
• 1.22.0
• 1.22.1
• 1.23.0

Website

• Product: https://github.com/kubeedge/kubeedge/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion