{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40924", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-15T20:40:15.517Z", "datePublished": "2026-04-21T20:47:47.178Z", "dateUpdated": "2026-04-21T20:47:47.178Z"}, "containers": {"cna": {"title": "Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/tektoncd/pipeline/security/advisories/GHSA-m2cx-gpqf-qf74", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tektoncd/pipeline/security/advisories/GHSA-m2cx-gpqf-qf74"}, {"name": "https://github.com/tektoncd/pipeline/releases/tag/v1.11.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/tektoncd/pipeline/releases/tag/v1.11.1"}], "affected": [{"vendor": "tektoncd", "product": "pipeline", "versions": [{"version": "< 1.11.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T20:47:47.178Z"}, "descriptions": [{"lang": "en", "value": "Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Prior to 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http implementations. This vulnerability is fixed in 1.11.1."}], "source": {"advisory": "GHSA-m2cx-gpqf-qf74", "discovery": "UNKNOWN"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Prior to 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http implementations. This vulnerability is fixed in 1.11.1."}], "id": "CVE-2026-40924", "lastModified": "2026-04-21T21:16:45.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-21T21:16:45.720", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/tektoncd/pipeline/releases/tag/v1.11.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/tektoncd/pipeline/security/advisories/GHSA-m2cx-gpqf-qf74"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.11.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "pipeline", "source": "cna", "vendor": "tektoncd"}, "product": "pipeline", "vendor": "tektoncd"}], "analysis": {"en": {"generated_at": "2026-04-22T06:24:20.130282+00:00", "value": {"mitigation_remediation": ["Upgrade Tekton Pipelines to version 1.11.1 or later, which limits the HTTP response body size in the resolver.", "If an upgrade is not immediately possible, restrict the creation of TaskRuns and PipelineRuns to trusted users or namespaces, and enforce strict quota limits on resolver pod memory to mitigate OOM effects.", "Disable or remove the HTTP resolver from the cluster configuration during remediation to eliminate the attack surface until a patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via memory exhaustion"}, "threat_synthesis": {"affected_systems": "All Tekton Pipeline installations using versions prior to 1.11.1 are affected, including every resolver type (Git, Hub, Bundle, Cluster, HTTP). Any tenant who can create TaskRuns or PipelineRuns has the authority to trigger the vulnerability by referencing an HTTP resolver pointed at a malicious endpoint.", "description_and_impact": "Tekton Pipelines\u2019 HTTP resolver reads HTTP response bodies without a size limit, leading to uncontrolled memory consumption when a malicious server delivers a very large payload. The vulnerability resides in the FetchHttpResource function of both the deprecated and current HTTP resolver implementations. When an overlarge body is processed, the tekton\u2011pipelines\u2011resolvers pod is OOM\u2011killed, interrupting all resolver services and causing a cluster\u2011wide denial of service. The weakness is characterized by CWE\u2011400.", "risk_and_exploitability": "The CVSS score of 6.5 indicates medium severity, and the lack of an EPSS score suggests there is no emerging widespread exploitation data. The vulnerability was not listed in CISA KEV. An attacker must have permissions to create TaskRuns or PipelineRuns; once privileged, they can induce the resolver pod to consume excessive memory and crash repeatedly, resulting in a sustained denial of service. The attack is cluster\u2011wide due to the shared resolver pod, but does not provide remote code execution or data exfiltration. The risk is primarily availability degradation."}}}}, "created": "2026-04-22T03:45:06.831242+00:00", "updated": "2026-04-22T06:30:10.673771+00:00", "vendors": ["tektoncd", "tektoncd$PRODUCT$pipeline"]}