CVE-2026-13322
published 2026-06-26CVE-2026-13322: A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input…
PriorityP417low3.8CVSS 3.1
AVLACLPRLUINSCCNINAL
EPSS
0.09%
0.7th percentile
A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| container-native-virtualization | virt-handler | — | — |
| container-native-virtualization | virt-handler-rhel9 | — | — |
| redhat | openshift_virtualization | 4 – 4.22.0 | — |
CVSS provenance
nvdv3.13.8LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
vendor_redhat3.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial ReadLine in virt-handler causes OOM denial of service
vendor_redhat·2026-06-25·CVSS 3.8
CVE-2026-13322 [LOW] CWE-770 kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial ReadLine in virt-handler causes OOM denial of service
kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial ReadLine in virt-handler causes OOM denial of service
A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.
Statement: Red Hat has rated this issue as having Low security impact. The vulnerable code runs in virt-handler, a node-level DaemonSet; however, in OpenShift Virtualization, cgroup memory limits ens
GHSA
A flaw was found in KubeVirt's downward metrics virtio-serial server.
ghsa_unreviewed·2026-06-26
CVE-2026-13322 [LOW] CWE-770 A flaw was found in KubeVirt's downward metrics virtio-serial server.
A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.
No detection rules found.
No public exploits indexed.
2026-06-26
Published