Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-18618

Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs in the affected namespace.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat OpenShift AI 2.25

Default version status: affected

  • 1785260280 to < *unaffected

Red Hat Red Hat OpenShift AI 3.3

Default version status: affected

  • 1785262015 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1785269945 to < *unaffected

Red Hat Red Hat OpenShift AI 3.4

Default version status: affected

  • 1791865241 to < *unaffected

Red Hat Red Hat OpenShift AI 3.5

Default version status: affected

  • 1786552271 to < *unaffected

Red Hat Red Hat OpenShift AI 3.5

Default version status: affected

  • 1786552250 to < *unaffected

References