Skip to content
OpenAdvisories

Package · Go

volcano.sh/volcano

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.8
    CVE-2026-44247

    Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body size

    Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitr…

    volcano-sh volcano volcano.sh/volcano Go
  • High 8.2
    CVE-2025-32777

    Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin

    Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacker compromise of either the Elastic service or the extender plugin can cause denial of service of the…

    volcano-sh volcano volcano.sh/volcano Go
  • Critical 9.8
    CVE-2024-36533

    Volcano has insecure permissions

    Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

    volcano.sh/volcano github.com/volcano-sh/volcano Go