Repository navigation
Security: knative/pkg
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Unbounded admission webhook body in knative.dev/pkg/webhook/admission.go: json.NewDecoder(io.TeeReader(r.Body, ...)) reads attacker-supplied AdmissionReview body without http.MaxBytesReader; affects every downstream consumer (Knative, Tekton, KEDA, Sigstore policy-controller, …) with no API change required to fix at the library level (same shape as CVE-2026-24514 and GHSA-9539-c3xr-w9vm)GHSA-2hw4-c9m4-f2fj published
Jun 4, 2026 by evankandersonModerate