CVE-2026-44247 Details
Description
Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook server exposed to in-cluster traffic are affected. This vulnerability is fixed in v1.14.2, v1.13.3, and v1.12.4.
A denial-of-service vulnerability has been identified in the Volcano batch scheduling system for Kubernetes, affecting versions prior to v1.14.2, v1.13.3, and v1.12.4. The issue arises because the Volcano webhook server does not limit the size of incoming HTTP request bodies. This lack of restriction allows any in-cluster pod with access to the webhook endpoint to send excessively large request bodies, potentially causing the webhook server to be terminated due to out-of-memory conditions. All Volcano deployments with the webhook server accessible to in-cluster traffic are vulnerable.
Users should upgrade to Volcano versions v1.14.2, v1.13.3, or v1.12.4.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/volcano-sh/volcano/security/advisories/GHSA-8wxp-xxp2-rcgx | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation volcano | < 1.12.4 >= 1.13.0, < 1.13.3 >= 1.14.0, < 1.14.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | New CVE Received | [email protected] |