Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion
Date: 2026-04
Affected: go/github.com/tektoncd/pipeline, go/github.com/tektoncd/pipeline, go/github.com/tektoncd/pipeline
Attack vector: dos
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-40923
CVE-2026-40924
CWE: CWE-22
CWE-400
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

## Summary The HTTP resolver's `FetchHttpResource` function calls `io.ReadAll(resp.Body)` with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the `tekton-pipelines-resolvers` pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated `pkg/resolution/resolver/http` and the current `pkg/remoteresolution/resolver/http` implementations. ## Details `pkg/resolution/resolver/http/resolver.go:279–307`: ```go func FetchHttpResource(ctx context.Context, params map[string]string, kubeclient kubernetes.Interface, logger *zap.SugaredLogger) (framework.ResolvedResource, error) { httpClient, err := makeHttpClient(ctx) // default timeout: 1 minute // ... resp, err := httpClient.Do(req) // ... defer func() { _ = resp.Body.Close() }() body, err := io.ReadAll(resp.Body) // ← no size limit if err != nil { return nil, fmt.Errorf("error reading response body: %w", err) } // ... } ``` `makeHttpClient` sets `http.Client{Timeout: timeout}` where `timeout` defaults to 1 minute and is configurable vi


Mitigations:

Architectural layers (MAESTRO):