knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion

影響: go:knative.dev/pkg < 0.0.0-20260531000007-52dbd5ece63f → 0.0.0-20260531000007-52dbd5ece63f

⚠️ Update (verification, 2026-05-19): C-2 confirmed end-to-end — 4.5× amplification observed (worse than the advisory's conservative 2× claim) Built a Go PoC ([cmd/poc-c2/main.go](https://github.com/knative/pkg/blob/1ad5a1ce0ee7043081cb50fd1acc6d36a9126844/cmd/poc-c2/main.go)) that runs the exact 8-line vulnerable snippet from [webhook/admission.go:109-117](https://github.com/knative/pkg/blob/1ad5a1ce0ee7043081cb50fd1acc6d36a9126844/webhook/admission.go#L109-L117) verbatim under the same http.H…

GitHub Advisory Databaseで読む

2026/10/29 06:20、GitHub Advisory Databaseが「knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Go、GitHub。