knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion

影響: go:knative.dev/pkg < 0.0.0-20260531000007-52dbd5ece63f → 0.0.0-20260531000007-52dbd5ece63f

⚠️ Update (verification, 2026-05-19): C-2 confirmed end-to-end — 4.5× amplification observed (worse than the advisory's conservative 2× claim) Built a Go PoC ([cmd/poc-c2/main.go](https://github.com/knative/pkg/blob/1ad5a1ce0ee7043081cb50fd1acc6d36a9126844/cmd/poc-c2/main.go)) that runs the exact 8-line vulnerable snippet from [webhook/admission.go:109-117](https://github.com/knative/pkg/blob/1ad5a1ce0ee7043081cb50fd1acc6d36a9126844/webhook/admission.go#L109-L117) verbatim under the same http.H…

Read on GitHub Advisory Database

On 10/29/2026, 06:20 AM, GitHub Advisory Database published "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion" (type: Advisory). Severity is "Medium" (medium). Related technologies: Go, GitHub.