{"id":"CVE-2026-33022","title":"github.com/tektoncd/pipeline: Tekton Pipelines: Denial of Service via long resolver names (CVE-2026-33022)","summary":"A denial of service flaw was found in Tekton Pipelines. Any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-130","vendor":"Red Hat","product":"OpenShift Pipelines","affected":["builds_for_red_hat_openshift","openshift_pipelines","openshift_serverless","openshift_ai_rhoai","openshift_virtualization 4","trusted_artifact_signer","openshift_pipelines 1.21","openshift_pipelines 1.2"],"patched":["openshift_pipelines 1.21","openshift_pipelines 1.2"],"published":"2026-03-20","updated":"2026-09-21","sourceUpdated":"2026-09-21T17:16:09+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33022.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33022.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-33022"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449483"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33022"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33022"},{"url":"https://github.com/tektoncd/pipeline/commit/5eead3f859b9f938e86039e4d29185092c1d4ee6"},{"url":"https://github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj"},{"url":"https://access.redhat.com/errata/RHSA-2026:6166"},{"url":"https://access.redhat.com/errata/RHSA-2026:6170"},{"url":"https://access.redhat.com/errata/RHSA-2026:10026"},{"url":"https://access.redhat.com/errata/RHSA-2026:10066"},{"url":"https://github.com/tektoncd/pipeline/commit/5eead3f859b9"},{"url":"https://github.com/tektoncd/pipeline/commit/01673237c464"},{"url":"https://github.com/tektoncd/pipeline/commit/edc64bbf2232"},{"url":"https://github.com/tektoncd/pipeline/commit/0fa2d66cff81"},{"url":"https://github.com/tektoncd/pipeline/commit/5e4905fb6754"},{"url":"https://github.com/tektoncd/pipeline/commit/ebc197e2b973"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00368,"epssPercentile":0.30703,"aliases":["GO-2026-4730","GHSA-cv4x-93xx-wgfj"],"ecosystem":"go","ingestedAt":"2026-07-24T19:07:03.235Z","slug":"CVE-2026-33022","body":"## Overview\n\nA denial of service flaw was found in Tekton Pipelines. Any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness.\n\n## Vendor advisories\n\n- **RHSA-2026:6166** · Red Hat · fixed in: Red Hat OpenShift Pipelines 1.21 · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6166)\n- **RHSA-2026:6170** · Red Hat · fixed in: Red Hat OpenShift Pipelines 1.21 · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6170)\n- **RHSA-2026:10026** · Red Hat · fixed in: Red Hat OpenShift Pipelines 1.2 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10026)\n- **RHSA-2026:10066** · Red Hat · fixed in: Red Hat OpenShift Pipelines 1.2 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10066)\n- **Red Hat VEX** · Moderate · affected: Builds for Red Hat OpenShift, OpenShift Pipelines, OpenShift Serverless, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Virtualization 4, Red Hat Trusted Artifact Signer · no fix planned: Builds for Red Hat OpenShift, OpenShift Pipelines, OpenShift Serverless, Red Hat OpenShift AI (RHOAI), … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33022.json)\n\n**github.com/tektoncd/pipeline: Tekton Pipelines: Denial of Service via long resolver names** — rated Moderate by Red Hat. Released 2026-03-20, updated 2026-09-21.\n\nAffected:\n\n- Builds for Red Hat OpenShift\n- OpenShift Pipelines\n- OpenShift Serverless\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Virtualization 4\n- Red Hat Trusted Artifact Signer\n\nFixed:\n\n- Red Hat OpenShift Pipelines 1.21\n- Red Hat OpenShift Pipelines 1.2\n\nNo fix planned:\n\n- Builds for Red Hat OpenShift\n- OpenShift Pipelines\n- OpenShift Serverless\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Virtualization 4\n- Red Hat Trusted Artifact Signer\n\nNot affected:\n\n- Red Hat OpenShift Pipelines 1.21\n- Red Hat OpenShift Pipelines 1.2\n\n## Remediation\n\nRed Hat OpenShift Pipelines is a cloud-native, continuous integration and\ncontinuous delivery (CI/CD) solution based on Kubernetes resources.\nIt uses Tekton building blocks to automate deployments across multiple\nplatforms by abstracting away the underlying implementation details.\nTekton introduces a number of standard custom resource definitions (CRDs)\nfor defining CI/CD pipelines that are portable across Kubernetes distributions. https://access.redhat.com/errata/RHSA-2026:6166\nRed Hat OpenShift Pipelines is a cloud-native, continuous integration and\ncontinuous delivery (CI/CD) solution based on Kubernetes resources.\nIt uses Tekton building blocks to automate deployments across multiple\nplatforms by abstracting away the underlying implementation details.\nTekton introduces a number of standard custom resource definitions (CRDs)\nfor defining CI/CD pipelines that are portable across Kubernetes distributions. https://access.redhat.com/errata/RHSA-2026:6170\nRed Hat OpenShift Pipelines is a cloud-native, continuous integration and\ncontinuous delivery (CI/CD) solution based on Kubernetes resources.\nIt uses Tekton building blocks to automate deployments across multiple\nplatforms by abstracting away the underlying implementation details.\nTekton introduces a number of standard custom resource definitions (CRDs)\nfor defining CI/CD pipelines that are portable across Kubernetes distributions. https://access.redhat.com/errata/RHSA-2026:10026\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2026-33022)\n\nAffected packages:\n\n- `github.com/tektoncd/pipeline >= 1.10.0, < 1.10.2`\n\nPatched in:\n\n- `github.com/tektoncd/pipeline 1.10.2`\n\nSource: https://osv.dev/vulnerability/GO-2026-4730","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":208968,"id":"CVE-2026-33022","ts":1790062303294,"field":"cvss","old":null,"new":"6.5"},{"seq":208967,"id":"CVE-2026-33022","ts":1790062303294,"field":"severity","old":"none","new":"medium"}]}