Tekton Pipelines crashes its controller when a TaskRun or PipelineRun specifies a custom resolver name of 31 or more characters. The controller generates a deterministic name that exceeds the 63‑character DNS‑1123 label limit; its truncation logic panics, leading to a CrashLoopBackOff that blocks all CI/CD reconciliation until the offending resource is removed. This results in a temporary denial of service for all pipeline activity in the affected cluster.

The vulnerability impacts the Tekton Pipelines project from the Linux Foundation. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 are affected. All other releases, including 1.0.1 and later patch versions, are considered safe.

With a CVSS score of 6.5, the threat is moderate. The EPSS score is below 1%, indicating low immediate exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, any user who can create a TaskRun or PipelineRun within the cluster—whether through a CI/CD integration or direct API access—can trigger the crash. The attack does not require remote network access beyond legitimate cluster permissions, but it can disrupt entire CI/CD pipelines cluster‑wide, especially in environments where long custom resolver names are used.