CVE-2026-40924
Fixed in a distro release EPSS <1%CVSS 6.5
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http implementations. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.
Products: tektoncd pipeline
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/tektoncd/pipeline | 1.11.1 |
| Go | github.com/tektoncd/pipeline | 1.0.2 |
| Go | github.com/tektoncd/pipeline | 1.3.4 |
| Go | github.com/tektoncd/pipeline | 1.6.2 |
| Go | github.com/tektoncd/pipeline | 1.9.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | tekton-chains | 0.26.3-r0 |
| Chainguard | tekton-chains-fips | 0.26.3-r0 |
| Chainguard | tekton-pipelines-controller-0.65 | no fix |
| Chainguard | tekton-pipelines-controller-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-controller-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-controller-1.10 | no fix |
| Chainguard | tekton-pipelines-controller-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-controller-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-controller-1.5 | no fix |
| Chainguard | tekton-pipelines-controller-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-controller-1.7 | no fix |
| Chainguard | tekton-pipelines-controller-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-controller-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-controller-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-controller-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-controller-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-controller-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-controller-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-controller-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-controller-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-controller-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-controller-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-entrypoint-0.65 | no fix |
| Chainguard | tekton-pipelines-entrypoint-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-entrypoint-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-entrypoint-1.10 | no fix |
| Chainguard | tekton-pipelines-entrypoint-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-entrypoint-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-entrypoint-1.5 | no fix |
| Chainguard | tekton-pipelines-entrypoint-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-entrypoint-1.7 | no fix |
| Chainguard | tekton-pipelines-entrypoint-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-entrypoint-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-entrypoint-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-events-0.65 | no fix |
| Chainguard | tekton-pipelines-events-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-events-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-events-1.10 | no fix |
| Chainguard | tekton-pipelines-events-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-events-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-events-1.5 | no fix |
| Chainguard | tekton-pipelines-events-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-events-1.7 | no fix |
| Chainguard | tekton-pipelines-events-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-events-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-events-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-events-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-events-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-events-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-events-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-events-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-events-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-events-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-events-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-nop-0.65 | no fix |
| Chainguard | tekton-pipelines-nop-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-nop-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-nop-1.10 | no fix |
| Chainguard | tekton-pipelines-nop-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-nop-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-nop-1.5 | no fix |
| Chainguard | tekton-pipelines-nop-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-nop-1.7 | no fix |
| Chainguard | tekton-pipelines-nop-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-nop-fips-0.65 | 0 |
| Chainguard | tekton-pipelines-nop-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-nop-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-nop-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-nop-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-nop-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-nop-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-nop-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-nop-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-nop-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-nop-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-resolvers-0.65 | no fix |
| Chainguard | tekton-pipelines-resolvers-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-resolvers-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-resolvers-1.10 | no fix |
| Chainguard | tekton-pipelines-resolvers-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-resolvers-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-resolvers-1.5 | no fix |
| Chainguard | tekton-pipelines-resolvers-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-resolvers-1.7 | no fix |
| Chainguard | tekton-pipelines-resolvers-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-resolvers-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-resolvers-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-resolvers-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-resolvers-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-resolvers-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-resolvers-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-resolvers-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-sidecarlogresults-0.65 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.10 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.5 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-1.7 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-webhook-0.65 | no fix |
| Chainguard | tekton-pipelines-webhook-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-webhook-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-webhook-1.10 | no fix |
| Chainguard | tekton-pipelines-webhook-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-webhook-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-webhook-1.5 | no fix |
| Chainguard | tekton-pipelines-webhook-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-webhook-1.7 | no fix |
| Chainguard | tekton-pipelines-webhook-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-webhook-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-webhook-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-webhook-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-webhook-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-webhook-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-webhook-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-webhook-fips-1.9 | 1.9.3-r3 |
| Chainguard | tekton-pipelines-workingdirinit-0.65 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-0.68 | 0.68.1-r19 |
| Chainguard | tekton-pipelines-workingdirinit-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-workingdirinit-1.10 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-workingdirinit-1.4 | 1.4.0-r19 |
| Chainguard | tekton-pipelines-workingdirinit-1.5 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-workingdirinit-1.7 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-1.9 | 1.9.3-r2 |
| Chainguard | tekton-pipelines-workingdirinit-fips-0.65 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-0.68 | 0.68.1-r21 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.0 | 1.0.2-r3 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.10 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.3 | 1.3.4-r2 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.4 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.5 | no fix |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.6 | 1.6.2-r2 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.7 | 1.7.0-r14 |
| Chainguard | tekton-pipelines-workingdirinit-fips-1.9 | 1.9.3-r3 |
| Chainguard | tkn | 0.44.1-r4 |
| Chainguard | tkn-fips | 0.44.1-r4 |
| Wolfi | tekton-chains | 0.26.3-r0 |
| Wolfi | tekton-pipelines-controller-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-controller-1.10 | no fix |
| Wolfi | tekton-pipelines-controller-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-controller-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-controller-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-controller-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-entrypoint-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-entrypoint-1.10 | no fix |
| Wolfi | tekton-pipelines-entrypoint-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-entrypoint-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-entrypoint-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-entrypoint-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-events-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-events-1.10 | no fix |
| Wolfi | tekton-pipelines-events-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-events-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-events-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-events-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-nop-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-nop-1.10 | no fix |
| Wolfi | tekton-pipelines-nop-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-nop-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-nop-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-nop-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-resolvers-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-resolvers-1.10 | no fix |
| Wolfi | tekton-pipelines-resolvers-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-resolvers-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-resolvers-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-resolvers-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.10 | no fix |
| Wolfi | tekton-pipelines-sidecarlogresults-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-sidecarlogresults-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-webhook-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-webhook-1.10 | no fix |
| Wolfi | tekton-pipelines-webhook-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-webhook-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-webhook-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-webhook-1.9 | 1.9.3-r2 |
| Wolfi | tekton-pipelines-workingdirinit-1.0 | 1.0.2-r3 |
| Wolfi | tekton-pipelines-workingdirinit-1.10 | no fix |
| Wolfi | tekton-pipelines-workingdirinit-1.3 | 1.3.4-r2 |
| Wolfi | tekton-pipelines-workingdirinit-1.4 | 1.4.0-r19 |
| Wolfi | tekton-pipelines-workingdirinit-1.6 | 1.6.2-r2 |
| Wolfi | tekton-pipelines-workingdirinit-1.9 | 1.9.3-r2 |
| Wolfi | tkn | 0.44.1-r4 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |