{"id":"CVE-2026-118761","aliases":["EUVD-2026-113219","GHSA-8fmv-6rg5-5924","GO-2026-6899"],"status":"published","title":"Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory","description":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00495,"percentile":0.42988,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-409"],"published":"2026-10-29T16:37:44Z","modified":"2026-11-05T23:26:17Z","fixes":[{"ecosystem":"Go","package":"github.com/kubeflow/pipelines","fixed_in":["0.0.0-20260831164314-ba9ae72cc860"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/kubeflow/pipelines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20260831164314-ba9ae72cc860"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kubeflow/pipelines","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0-alpha.3"},{"last_affected":"1.7.0-alpha.3"}]}],"versions":["1.7.0-alpha.3"]},{"source":"osv","ecosystem":"Go","package":"github.com/kubeflow/pipelines","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260831164314-ba9ae72cc860"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kubeflow/pipelines","versions":["1.7.0-alpha.3"]},{"source":"osv","ecosystem":"Go","package":"github.com/kubeflow/pipelines","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260831164314-ba9ae72cc860"}]}]}],"products":[{"vendor":"kubeflow","product":"pipelines"},{"vendor":"red hat","product":"pipelines"}],"references":[{"url":"https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/kubeflow/pipelines/pull/14171","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/kubeflow/pipelines/pull/14186","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/kubeflow/pipelines/releases/tag/2.18.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118761","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8fmv-6rg5-5924"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118761.json","tags":["advisory"]},{"url":"https://github.com/kubeflow/pipelines","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-118761","title":"Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory","description":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.","status":"published","published":"2026-10-29T16:37:44.333Z","modified":"2026-10-29T20:18:59.625Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T14:20:04.156238Z"}],"euvd":[{"id":"EUVD-2026-113219","description":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.","status":"published","published":"2026-10-29T16:37:44Z","modified":"2026-10-29T20:18:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:14.591479Z"}],"ghsa":[{"id":"GHSA-8fmv-6rg5-5924","title":"Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory","description":"## Summary\n\nThe Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file, potentially exhausting API-server resources and interrupting service.\n\nMultipart pipeline and pipeline-version upload processing decompresses the archive before namespace authorization, so a caller who can reach those endpoints does not need a successful pipeline-create authorization decision to trigger the issue. External authentication and network controls can restrict reachability. URL-import handlers authorize before fetching and decompressing a remote archive.\n\nThe amount of expansion needed to exhaust memory depends on deployment resource limits and concurrent activity; no particular archive is guaranteed to crash every deployment.\n\n## Remediation\n\nUpgrade the API server to **[Kubeflow Pipelines 2.18.0](https://github.com/kubeflow/pipelines/releases/tag/2.18.0)**. Versions through 2.17.3 are affected; the first affected release has not been established.\n\n[PR #14171](https://github.com/kubeflow/pipelines/pull/14171) bounds compressed input and extracted pipeline data. [PR #14186](https://github.com/kubeflow/pipelines/pull/14186) strengthens the total tar traversal budget, including metadata and skipped entries. The 2.18 release also includes configurable upload and specification limits; operators should review the shipped settings and resource budget. These controls address pipeline archive amplification and do not establish general HTTP-body, temporary-disk, concurrency, or CPU limits.\n\nUntil upgrading, restrict access to upload and import endpoints and apply deployment-level request and resource controls. A compressed upload-size limit alone does not prevent decompression amplification. Regression tests cover compressed input, selected-entry boundaries, and tar traversal budgets; no deployed-server OOM test was performed for this assessment.\n\n## Credit\n\n[bugbunny.ai](https://bugbunny.ai) discovered and reported the issue. Ayush Gupta ([@Ayush-kathil](https://github.com/Ayush-kathil)) authored the archive fixes in #14171 and #14186, with Jeff Spahr ([@jeffspahr](https://github.com/jeffspahr)) contributing regression coverage to #14171.\n\n[@BrianWillows](https://github.com/BrianWillows) later submitted a mixed report that included source analysis of pipeline-archive decompression.","status":"published","published":"2026-10-30T23:13:38Z","modified":"2026-10-30T23:13:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T14:41:42.013329Z"}],"nvd":[{"id":"CVE-2026-118761","description":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.","status":"published","published":"2026-10-29T17:18:06.907Z","modified":"2026-10-30T17:18:03.88Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T14:13:04.940026Z"}],"osv":[{"id":"CVE-2026-118761","title":"Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory","description":"Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.","status":"published","published":"2026-10-29T16:37:44.333Z","modified":"2026-11-05T23:26:17.887266288Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-409"],"updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"GHSA-8fmv-6rg5-5924","title":"Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory","description":"## Summary\n\nThe Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file, potentially exhausting API-server resources and interrupting service.\n\nMultipart pipeline and pipeline-version upload processing decompresses the archive before namespace authorization, so a caller who can reach those endpoints does not need a successful pipeline-create authorization decision to trigger the issue. External authentication and network controls can restrict reachability. URL-import handlers authorize before fetching and decompressing a remote archive.\n\nThe amount of expansion needed to exhaust memory depends on deployment resource limits and concurrent activity; no particular archive is guaranteed to crash every deployment.\n\n## Remediation\n\nUpgrade the API server to **[Kubeflow Pipelines 2.18.0](https://github.com/kubeflow/pipelines/releases/tag/2.18.0)**. Versions through 2.17.3 are affected; the first affected release has not been established.\n\n[PR #14171](https://github.com/kubeflow/pipelines/pull/14171) bounds compressed input and extracted pipeline data. [PR #14186](https://github.com/kubeflow/pipelines/pull/14186) strengthens the total tar traversal budget, including metadata and skipped entries. The 2.18 release also includes configurable upload and specification limits; operators should review the shipped settings and resource budget. These controls address pipeline archive amplification and do not establish general HTTP-body, temporary-disk, concurrency, or CPU limits.\n\nUntil upgrading, restrict access to upload and import endpoints and apply deployment-level request and resource controls. A compressed upload-size limit alone does not prevent decompression amplification. Regression tests cover compressed input, selected-entry boundaries, and tar traversal budgets; no deployed-server OOM test was performed for this assessment.\n\n## Credit\n\n[bugbunny.ai](https://bugbunny.ai) discovered and reported the issue. Ayush Gupta ([@Ayush-kathil](https://github.com/Ayush-kathil)) authored the archive fixes in #14171 and #14186, with Jeff Spahr ([@jeffspahr](https://github.com/jeffspahr)) contributing regression coverage to #14171.\n\n[@BrianWillows](https://github.com/BrianWillows) later submitted a mixed report that included source analysis of pipeline-archive decompression.","status":"published","published":"2026-10-30T23:13:38Z","modified":"2026-11-05T23:26:17.887266288Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-409"],"updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"GO-2026-6899","title":"Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory in github.com/kubeflow/pipelines","description":"Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory in github.com/kubeflow/pipelines","status":"published","published":"2026-11-05T22:54:57Z","modified":"2026-11-05T23:15:15.757712608Z","updated_at":"2026-11-06T00:02:13.631839Z"}]}}