The Volcano webhook server lacks a size limit on HTTP request bodies, enabling an in‑cluster pod to send an arbitrarily large payload that can exhaust memory and terminate the process. This failure to enforce resource bounds is a classic resource‑exhaustion flaw (CWE‑400 and CWE‑770) that results in service disruption as the webhook server is killed by the operating system.

Deployments of Volcano version 1.14.2, 1.13.3, and 1.12.4 contain the fix; any earlier releases of the Volcano batch scheduler are vulnerable. All webhook servers that are reachable from in‑cluster pods are affected, as any pod can contact the endpoint.

The CVSS score of 6.8 indicates moderate severity. Based on the description, it is inferred that the vulnerability can be triggered from any pod within the cluster, implying an internal attack vector that does not require privileged access. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting that public exploitation may be limited, but the potential for application outage remains high. Patch or mitigate the request size to reduce the likelihood of an OOM crash.