Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacker compromise of either the Elastic service or the extender plugin can cause denial of service of the scheduler. This is a privilege escalation, because Volcano users may run their Elastic service and extender plugins in separate pods or nodes from the scheduler. In the Kubernetes security model, node isolation is a security boundary, and as such an attacker is able to cross that boundary in Volcano's case if they have compromised either the vulnerable services or the pod/node in which they are deployed. The scheduler will become unavailable to other users and workloads in the cluster. The scheduler will either crash with an unrecoverable OOM panic or freeze while consuming excessive amounts of memory. This issue has been patched in versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| volcano-sh | volcano | 1.11.0 to before 1.11.2; 1.10.0-alpha.0 to before 1.10.2; before 1.9.1; 1.11.0-network-topology-preview.0 to before 1.11.0-network-topology-preview.3; 1.12.0-alpha.0 to before 1.12.0-alpha.2 | 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, 1.12.0-alpha.2 | Patch available | CNA |
| — | volcano.sh/volcano (Go) | before 1.9.1 | 1.9.1 | Patch available | GHSA-hg79-fw4p-25p8 |
| — | volcano.sh/volcano (Go) | 1.10.0-alpha.0 to before 1.10.2 | 1.10.2 | Patch available | GHSA-hg79-fw4p-25p8 |
| — | volcano.sh/volcano (Go) | 1.11.0-network-topology-preview.0 to before 1.11.0-network-topology-preview.3 | 1.11.0-network-topology-preview.3 | Patch available | GHSA-hg79-fw4p-25p8 |
| — | volcano.sh/volcano (Go) | 1.11.0 to before 1.11.2 | 1.11.2 | Patch available | GHSA-hg79-fw4p-25p8 |
| — | volcano.sh/volcano (Go) | 1.12.0-alpha.0 to before 1.12.0-alpha.2 | 1.12.0-alpha.2 | Patch available | GHSA-hg79-fw4p-25p8 |
- volcano Vendorvolcano-sh Affected 1.11.0 to before 1.11.2; 1.10.0-alpha.0 to before 1.10.2; before 1.9.1; 1.11.0-network-topology-preview.0 to before 1.11.0-network-topology-preview.3; 1.12.0-alpha.0 to before 1.12.0-alpha.2 Fixed in 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, 1.12.0-alpha.2 Patch available CNA
- volcano.sh/volcano (Go) Vendor— Affected before 1.9.1 Fixed in 1.9.1 Patch available GHSA-hg79-fw4p-25p8
- volcano.sh/volcano (Go) Vendor— Affected 1.10.0-alpha.0 to before 1.10.2 Fixed in 1.10.2 Patch available GHSA-hg79-fw4p-25p8
- volcano.sh/volcano (Go) Vendor— Affected 1.11.0-network-topology-preview.0 to before 1.11.0-network-topology-preview.3 Fixed in 1.11.0-network-topology-preview.3 Patch available GHSA-hg79-fw4p-25p8
- volcano.sh/volcano (Go) Vendor— Affected 1.11.0 to before 1.11.2 Fixed in 1.11.2 Patch available GHSA-hg79-fw4p-25p8
- volcano.sh/volcano (Go) Vendor— Affected 1.12.0-alpha.0 to before 1.12.0-alpha.2 Fixed in 1.12.0-alpha.2 Patch available GHSA-hg79-fw4p-25p8
Remediation
- Fix · CNA volcano (volcano-sh) Fixed in 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, 1.12.0-alpha.2
- Fix · GHSA-hg79-fw4p-25p8 volcano.sh/volcano (Go) Fixed in 1.9.1 Advisory →
- Fix · GHSA-hg79-fw4p-25p8 volcano.sh/volcano (Go) Fixed in 1.10.2 Advisory →
- Fix · GHSA-hg79-fw4p-25p8 volcano.sh/volcano (Go) Fixed in 1.11.0-network-topology-preview.3 Advisory →
- Fix · GHSA-hg79-fw4p-25p8 volcano.sh/volcano (Go) Fixed in 1.11.2 Advisory →
- Fix · GHSA-hg79-fw4p-25p8 volcano.sh/volcano (Go) Fixed in 1.12.0-alpha.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-32777
- 2026-10-03 Alias added: GHSA-hg79-fw4p-25p8
References
Other 13
- https://github.com/volcano-sh/volcano/security/advisories/GHSA-hg79-fw4p-25p8
- https://github.com/volcano-sh/volcano/releases/tag/v1.10.2
- https://github.com/volcano-sh/volcano/releases/tag/v1.11.0-network-topology-preview.3
- https://github.com/volcano-sh/volcano/releases/tag/v1.11.2
- https://github.com/volcano-sh/volcano/releases/tag/v1.12.0-alpha.2
- https://github.com/volcano-sh/volcano/releases/tag/v1.9.1
- https://github.com/volcano-sh/volcano/commit/45a4347471a5254121d10afef04c6732095fa398
- https://github.com/volcano-sh/volcano/commit/7103c18de19821cd278f949fa24c13da350a8c5d
- https://github.com/volcano-sh/volcano/commit/735842af59b9be0da5090677db7693c98a798b2a
- https://github.com/volcano-sh/volcano/commit/7c0ea53fa3cfa7a05b5fba7a8af7bfe88adc41c3
- https://github.com/volcano-sh/volcano/commit/d687f75a11fa36f37b54e4b6ff8e49bc0a3ca6b4
- https://github.com/volcano-sh/volcano
- https://pkg.go.dev/vuln/GO-2025-3656
Sources
- CVE-2025-32777 · CVE Program
- CVE-2025-32777 · NVD
- FIRST EPSS
- GHSA-hg79-fw4p-25p8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences