Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-40924— Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion

Quick assessment

Affected

tektoncd pipeline

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tekton Pipelines是Tekton开源的一个云原生管道。 Tekton Pipelines 1.11.1之前版本存在资源管理错误漏洞，该漏洞源于HTTP解析器的FetchHttpResource函数调用io.ReadAll(resp.Body)时未限制响应体大小，可能导致拥有创建TaskRuns或PipelineRuns权限的租户指向攻击者控制的HTTP服务器并返回超大响应体，造成tekton-pipelines-resolvers pod因内存不足被终止。

CVSS 6.5 · Medium EPSS 0.32% · P25 Updated May 23, 2026

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 5

Vendor	Product	Version Range	Status
tektoncd	pipeline	`>= 1.0.0, < 1.0.2`	affected
		`>= 1.2.0, < 1.3.4`	affected
		`>= 1.4.0, < 1.6.2`	affected
		`>= 1.7.0, < 1.9.3`	affected
		`>= 1.10.0, < 1.11.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-40924

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion

Source: CVE Program / CVE List V5

Vulnerability Description

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http implementations. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

未加控制的资源消耗(资源穷尽)

Source: CVE Program / CVE List V5

Vulnerability Title

Tekton Pipelines 资源管理错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
tektoncd	pipeline	>= 1.0.0, < 1.0.2	-

II. Public POCs for CVE-2026-40924

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-40924

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-40924 (1)

🔗 HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion · Advisory · tektoncd/pipeline · GitHub Read full article x_refsource_CONFIRM

Vendor Pages for CVE-2026-40924 (1)

🔗 Release Tekton Pipeline release v1.11.1 "Javanese Jocasta" · tektoncd/pipeline · GitHub Read full article x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-40924

Same Patch Batch · tektoncd · 2026-04-21 · 5 CVEs total

CVE-2026-40161	7.7 HIGH	Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controll
CVE-2026-40938	7.5 HIGH	Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injecti
CVE-2026-25542	6.5 MEDIUM	Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching
CVE-2026-40923	5.4 MEDIUM	Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekto

IV. Related Vulnerabilities

Same product: pipeline

Same vendor: tektoncd

Same weakness: CWE-400