CVE-2026-62370Medium· 6.5▾ Sunlit

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score36/ 100 · Low

impact 35.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 21, 2026

Updated

Sep 21, 2026

CVSS

6.5

Vendor

kubeedge

Product

kubeedge

CWE

CWE-789

Depth score

36 · Low

EPSS

—

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

kubeedge CWE-789 #nvd #cve.org

Affected

kubeedge >= 1.0.0, < 1.21.2
kubeedge >= 1.22.0, < 1.22.2
kubeedge >= 1.23.0, < 1.23.1

Full technical detail▾

Overview

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org