KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.
CVE-2026-62370
This medium-severity CVE scores 6.5 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.9%, top 42% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
- Lower severity and no public exploit yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 6.5
- EG Score
- 6.5(medium)
- EG Risk
- 34(Track)EG Risk 34/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity65% × 45%Exploitation1% × 40%Automatability30% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 1%
- EPSS %ILE
- 58%
- KEV
- Not listed
Published
September 21, 2026
Last Modified
September 24, 2026
Advisory Details (10)
Auto-updated Sep 21, 2026kubeedge/CHANGELOG/CHANGELOG-1.23.md at master · kubeedge/kubeedge · GitHub
https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.23.mdkubeedge/CHANGELOG/CHANGELOG-1.22.md at master · kubeedge/kubeedge · GitHub
https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.22.mdkubeedge/CHANGELOG/CHANGELOG-1.21.md at master · kubeedge/kubeedge · GitHub
https://github.com/kubeedge/kubeedge/blob/master/CHANGELOG/CHANGELOG-1.21.mdcommit cc79621943ff (kubeedge/kubeedge)
Fix landed in kubeedge/kubeedge commit cc79621943ff — awaiting tagged release
https://github.com/kubeedge/kubeedge/commit/cc79621943fff9d3f62638d9403ef0cfeda3d0e7commit 725a73ca35a6 (kubeedge/kubeedge)
Fix landed in kubeedge/kubeedge commit 725a73ca35a6 — awaiting tagged release
https://github.com/kubeedge/kubeedge/commit/725a73ca35a65d91aa6338e52b8faaab6058f528commit 0fe1ea18e5d7 (kubeedge/kubeedge)
Fix landed in kubeedge/kubeedge commit 0fe1ea18e5d7 — awaiting tagged release
https://github.com/kubeedge/kubeedge/commit/0fe1ea18e5d7fde29633286ddf1c7e71cb39606f[release-1.21] Backport security hardening fixes for v1.21.2
Fix merged in kubeedge/kubeedge PR #7030 on 2026-07-15 — awaiting tagged release
https://github.com/kubeedge/kubeedge/pull/7030[release-1.22] Backport security hardening fixes for v1.22.2
Fix merged in kubeedge/kubeedge PR #7029 on 2026-07-15 — awaiting tagged release
https://github.com/kubeedge/kubeedge/pull/7029[release-1.23] Backport security hardening fixes for v1.23.1
Fix merged in kubeedge/kubeedge PR #7028 on 2026-07-15 — awaiting tagged release
https://github.com/kubeedge/kubeedge/pull/7028Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub · Advisory · kubeedge/kubeedge · GitHub
https://github.com/kubeedge/kubeedge/security/advisories/GHSA-gfw4-49f9-cp25Vendor Advisories for CVE-2026-62370(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Affected Packages
(1 across 1 ecosystem)
Go(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| github.com/kubeedge/kubeedge | — | 1.21.2 | — |
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 7× in last 7d / 7× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-09-24 21:23 UTCEG score recompute
- 2026-09-23 20:55 UTCEG score recompute
- 2026-09-23 17:54 UTCEPSS rescore
- 2026-09-22 19:10 UTCEG score recompute
- 2026-09-21 17:25 UTCEG score recompute
- 2026-09-21 17:10 UTCEG score recompute
- 2026-09-21 17:10 UTCMITRE cvelistV5first tracked
Related CVEs(same product + same CWE)
Same product
10 shownGo:github.com/kubeedge/kubeedge
Frequently asked(5)
What is CVE-2026-62370?
When was CVE-2026-62370 disclosed?
Is CVE-2026-62370 actively exploited?
What is the CVSS score of CVE-2026-62370?
How do I remediate CVE-2026-62370?
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-62370
Is Your Infrastructure Affected by CVE-2026-62370?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.