KubeEdge CloudHub DoS Vulnerability Fixed in Upcoming Patches

The KubeEdge project has disclosed a medium-severity vulnerability, tracked as GHSA-gfw4-49f9-cp25, affecting its CloudHub component. According to the GitHub Security Advisory database, the issue arises from unbounded memory allocation in the viaduct packer, which decodes messages from connected peers. Authenticated edge nodes can exploit this flaw by sending crafted message headers with excessively large payload lengths, potentially leading to memory exhaustion, process termination, or denial of service. The vulnerability does not allow unauthenticated access or direct code execution.

The root cause is the viaduct packer's failure to validate payload lengths before allocating memory. To address this, the project has introduced a maximum payload size of 32 MiB in the upcoming patch releases: KubeEdge v1.23.1, v1.22.2, and v1.21.2. These patches enforce size limits in both the reader and writer components and include regression tests to ensure proper handling of oversized payloads.

Operators planning to upgrade should verify the compatibility of their edge nodes with the new payload size limit, as any nodes sending payloads exceeding 32 MiB may encounter communication issues. Additionally, operators should review their CloudHub endpoint access controls and edge-node credentials to mitigate risks while waiting for the patched versions to be released.