--- id: CVE-2026-33022 title: >- github.com/tektoncd/pipeline: Tekton Pipelines: Denial of Service via long resolver names (CVE-2026-33022) summary: >- A denial of service flaw was found in Tekton Pipelines. Any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. … severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: CWE-130 vendor: Red Hat product: OpenShift Pipelines affected: - builds_for_red_hat_openshift - openshift_pipelines - openshift_serverless - openshift_ai_rhoai - openshift_virtualization 4 - trusted_artifact_signer - openshift_pipelines 1.21 - openshift_pipelines 1.2 patched: - openshift_pipelines 1.21 - openshift_pipelines 1.2 published: '2026-03-20' updated: '2026-09-21' sourceUpdated: '2026-09-21T17:16:09+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33022.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33022.json - url: 'https://access.redhat.com/security/cve/CVE-2026-33022' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2449483' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-33022' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33022' - url: >- https://github.com/tektoncd/pipeline/commit/5eead3f859b9f938e86039e4d29185092c1d4ee6 - url: >- https://github.com/tektoncd/pipeline/security/advisories/GHSA-cv4x-93xx-wgfj - url: 'https://access.redhat.com/errata/RHSA-2026:6166' - url: 'https://access.redhat.com/errata/RHSA-2026:6170' - url: 'https://access.redhat.com/errata/RHSA-2026:10026' - url: 'https://access.redhat.com/errata/RHSA-2026:10066' - url: 'https://github.com/tektoncd/pipeline/commit/5eead3f859b9' - url: 'https://github.com/tektoncd/pipeline/commit/01673237c464' - url: 'https://github.com/tektoncd/pipeline/commit/edc64bbf2232' - url: 'https://github.com/tektoncd/pipeline/commit/0fa2d66cff81' - url: 'https://github.com/tektoncd/pipeline/commit/5e4905fb6754' - url: 'https://github.com/tektoncd/pipeline/commit/ebc197e2b973' tags: - csaf - vex - red-hat - osv - go epss: 0.00445 epssPercentile: 0.36011 aliases: - GO-2026-4730 - GHSA-cv4x-93xx-wgfj ecosystem: go ingestedAt: '2026-07-24T19:07:03.235Z' --- ## Overview A denial of service flaw was found in Tekton Pipelines. Any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness. ## Vendor advisories - **RHSA-2026:6166** · Red Hat · fixed in: Red Hat OpenShift Pipelines 1.21 · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6166) - **RHSA-2026:6170** · Red Hat · fixed in: Red Hat OpenShift Pipelines 1.21 · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6170) - **RHSA-2026:10026** · Red Hat · fixed in: Red Hat OpenShift Pipelines 1.2 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10026) - **RHSA-2026:10066** · Red Hat · fixed in: Red Hat OpenShift Pipelines 1.2 · released 2026-04-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:10066) - **Red Hat VEX** · Moderate · affected: Builds for Red Hat OpenShift, OpenShift Pipelines, OpenShift Serverless, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Virtualization 4, Red Hat Trusted Artifact Signer · no fix planned: Builds for Red Hat OpenShift, OpenShift Pipelines, OpenShift Serverless, Red Hat OpenShift AI (RHOAI), … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33022.json) **github.com/tektoncd/pipeline: Tekton Pipelines: Denial of Service via long resolver names** — rated Moderate by Red Hat. Released 2026-03-20, updated 2026-09-21. Affected: - Builds for Red Hat OpenShift - OpenShift Pipelines - OpenShift Serverless - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Virtualization 4 - Red Hat Trusted Artifact Signer Fixed: - Red Hat OpenShift Pipelines 1.21 - Red Hat OpenShift Pipelines 1.2 No fix planned: - Builds for Red Hat OpenShift - OpenShift Pipelines - OpenShift Serverless - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Virtualization 4 - Red Hat Trusted Artifact Signer Not affected: - Red Hat OpenShift Pipelines 1.21 - Red Hat OpenShift Pipelines 1.2 ## Remediation Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. https://access.redhat.com/errata/RHSA-2026:6166 Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. https://access.redhat.com/errata/RHSA-2026:6170 Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. https://access.redhat.com/errata/RHSA-2026:10026 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. ## Package advisory (CVE-2026-33022) Affected packages: - `github.com/tektoncd/pipeline >= 1.10.0, < 1.10.2` Patched in: - `github.com/tektoncd/pipeline 1.10.2` Source: https://osv.dev/vulnerability/GO-2026-4730