KubeEdge Websocket Client in package Viaduct: DoS from large response message
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, a large response received by the viaduct WSClient can cause a DoS from memory exhaustion. The entire body of the response is being read into memory which could allow an attacker to send a request that returns a response with a large body. The consequence of the exhaustion is that the process which invokes a WSClient will be in a denial of service. The software is affected If users who are authenticated to the edge side connect to `cloudhub` from the edge side through WebSocket protocol. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. There are currently no known workarounds.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | kubeedge | = 1.11.0; 1.10.0 to before 1.10.2; before 1.9.4 | 1.10.2, 1.9.4 | Patch available | CNA |
| — | github.com/kubeedge/kubeedge (Go) | 1.11.0 to before 1.11.1 | 1.11.1 | Patch available | GHSA-6wvc-6pww-qr4r |
| — | github.com/kubeedge/kubeedge (Go) | 1.10.0 to before 1.10.2 | 1.10.2 | Patch available | GHSA-6wvc-6pww-qr4r |
| — | github.com/kubeedge/kubeedge (Go) | before 1.9.4 | 1.9.4 | Patch available | GHSA-6wvc-6pww-qr4r |
- kubeedge Vendorbackstage Affected = 1.11.0; 1.10.0 to before 1.10.2; before 1.9.4 Fixed in 1.10.2, 1.9.4 Patch available CNA
- github.com/kubeedge/kubeedge (Go) Vendor— Affected 1.11.0 to before 1.11.1 Fixed in 1.11.1 Patch available GHSA-6wvc-6pww-qr4r
- github.com/kubeedge/kubeedge (Go) Vendor— Affected 1.10.0 to before 1.10.2 Fixed in 1.10.2 Patch available GHSA-6wvc-6pww-qr4r
- github.com/kubeedge/kubeedge (Go) Vendor— Affected before 1.9.4 Fixed in 1.9.4 Patch available GHSA-6wvc-6pww-qr4r
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:kubeedge:*:*:*:*:*:*:*:* | before 1.9.4; 1.10.0 to before 1.10.2; 1.11.0 to before 1.11.1 | Vulnerable | backstage |
- cpe:2.3:a:linuxfoundation:kubeedge:*:*:*:*:*:*:*:* Versions before 1.9.4; 1.10.0 to before 1.10.2; 1.11.0 to before 1.11.1 Vulnerable ·backstage
Remediation
- Fix · CNA kubeedge (kubeedge) Fixed in 1.10.2, 1.9.4
- Fix · GHSA-6wvc-6pww-qr4r github.com/kubeedge/kubeedge (Go) Fixed in 1.11.1 Advisory →
- Fix · GHSA-6wvc-6pww-qr4r github.com/kubeedge/kubeedge (Go) Fixed in 1.10.2 Advisory →
- Fix · GHSA-6wvc-6pww-qr4r github.com/kubeedge/kubeedge (Go) Fixed in 1.9.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31080
- 2026-10-03 Alias added: GHSA-6wvc-6pww-qr4r
References
More backstage Kubeedge vulnerabilities
- TI-2022-13117 KubeEdge Edge ServiceBus module DoS CVSS 3.1HIGH 7.5
- TI-2022-13120 Malicious Message can crash CloudCore in KubeEdge CVSS 3.1MEDIUM 5.7
- TI-2022-13119 KubeEdge DoS when signing the CSR from EdgeCore CVSS 3.1MEDIUM 6.5
- TI-2022-13123 KubeEdge Cloud Stream and Edge Stream DoS from large stream message CVSS 3.1MEDIUM 6.5
- TI-2022-13122 KubeEdge CloudCore Router memory exhaustion CVSS 3.1MEDIUM 6.5
- TI-2022-13118 KubeEdge Cloud AdmissionController component DoS CVSS 3.1MEDIUM 6.5
Sources
- CVE-2022-31080 · CVE Program
- CVE-2022-31080 · NVD
- FIRST EPSS
- GHSA-6wvc-6pww-qr4r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences