CVE-2026-40924 Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion

What is CVE-2026-40924?

CVE-2026-40924 is a medium-severity denial of service vulnerability in tektoncd pipeline, published on 21 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http implementations. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.

Weakness: CWE-400

Which versions are affected by CVE-2026-40924?

11 open source packages ship an affected version, including github.com/tektoncd/pipeline. It affects 1 product.

Products include Linuxfoundation Tekton Pipelines.

How do I fix CVE-2026-40924?

Upgrade github.com/tektoncd/pipeline to a fixed version for your release line: 1.0.2, 1.3.4, 1.6.2 or 1.9.3.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-40924 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40924 exists.

Other vulnerabilities in tektoncd pipeline

• CVE-2026-33211 Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod Critical 9.6
• CVE-2026-40161 Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL High 7.7
• CVE-2026-40938 Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE High 7.5
• CVE-2026-25542 Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching Medium 6.5
• CVE-2026-33022 Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-XM62440, GHSA-m2cx-gpqf-qf74, GO-2026-5486.