Package vulnerability, severity high

github.com/kubeflow/pipelines: Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Published October 30, 2026, updated October 31, 2026

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory. Source: GHSA-8fmv-6rg5-5924 (CVE-2026-118761).

What's affected

• github.com/kubeflow/pipelines (go)<0.0.0-20260831164314-ba9ae72cc860
• github.com/kubeflow/pipelines (go)1.7.0-alpha.3

What to do

1. Upgrade github.com/kubeflow/pipelines to 0.0.0-20260831164314-ba9ae72cc860 or later.
2. No fixed version of github.com/kubeflow/pipelines yet: see the advisory for workarounds.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident ghsa-8fmv-6rg5-5924

References

• https://osv.dev/vulnerability/GHSA-8fmv-6rg5-5924
• https://github.com/kubeflow/pipelines/security/advisories/GHSA-8fmv-6rg5-5924
• https://nvd.nist.gov/vuln/detail/CVE-2026-118761
• https://github.com/kubeflow/pipelines/pull/14171
• https://github.com/kubeflow/pipelines/pull/14186
• https://github.com/kubeflow/pipelines/commit/1121d9a081fdf9e2107c39abb2cd8947727c6953
• https://github.com/kubeflow/pipelines/commit/ba9ae72cc860e3afbea232185e4132fc2896cac5
• https://github.com/kubeflow/pipelines
• https://github.com/kubeflow/pipelines/releases/tag/2.18.0

Notice ghsa-8fmv-6rg5-5924, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.