The vulnerability allows a user with permission to create or update ComponentDefinition objects to supply a path that follows a symlink to /dev/zero. The loader reads the resulting unbounded stream before rejecting the content, exhausting memory and potentially triggering an out‑of‑memory kill of the cluster‑wide controller. This can cause repeated pod restarts and memory pressure on nodes, disrupting overall service availability.

Affected versions are kubevela releases prior to 1.9.14, 1.10.9, and 1.11.0-alpha.4. The issue occurs in the Terraform remote configuration loader located in pkg/controller/utils/capability.go.

With a CVSS score of 8.5 and no EPSS score available, the vulnerability is considered high severity but the likelihood of exploitation cannot be quantified from the available data. The issue is not listed in the CISA KEV catalog. Exploitation requires legitimate permission to create or update ComponentDefinition resources, a limitation that mitigates widespread exploitation but still poses a significant risk to organizations allowing such privileges.