Tekton Pipelines’ HTTP resolver reads HTTP response bodies without a size limit, leading to uncontrolled memory consumption when a malicious server delivers a very large payload. The vulnerability resides in the FetchHttpResource function of both the deprecated and current HTTP resolver implementations. When an overlarge body is processed, the tekton-pipelines-resolvers pod is OOM‑killed, interrupting all resolver services and causing a cluster‑wide denial of service. The weakness is characterized by CWE‑400 and CWE‑770.

All Tekton Pipeline installations using versions prior to 1.11.1 are affected, including every resolver type (Git, Hub, Bundle, Cluster, HTTP). Any tenant who can create TaskRuns or PipelineRuns has the authority to trigger the vulnerability by referencing an HTTP resolver pointed at a malicious endpoint.

The CVSS score of 6.5 indicates medium severity, and the EPSS score of < 1% indicates a very low exploitation probability. The vulnerability was not listed in CISA KEV. The weakness is characterized by excessive resource consumption (CWE‑400) and memory exhaustion (CWE‑770). An attacker must have permissions to create TaskRuns or PipelineRuns; once privileged, they can induce the resolver pod to consume excessive memory and crash repeatedly, resulting in a sustained denial of service. The attack is cluster‑wide due to the shared resolver pod, but does not provide remote code execution or data exfiltration. The risk is primarily availability degradation.