CVE-2026-31890

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31890", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T21:59:02.687Z", "datePublished": "2026-03-12T17:35:02.129Z", "dateUpdated": "2026-03-13T16:25:05.936Z"}, "containers": {"cna": {"title": "Inspektor Gadget: Tracing Denial of Service via Event Flooding", "problemTypes": [{"descriptions": [{"cweId": "CWE-223", "lang": "en", "description": "CWE-223: Omission of Security-relevant Information", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-wv52-frfv-mfh4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-wv52-frfv-mfh4"}], "affected": [{"vendor": "inspektor-gadget", "product": "inspektor-gadget", "versions": [{"version": "< 0.50.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T17:35:02.129Z"}, "descriptions": [{"lang": "en", "value": "Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. Prior to 0.50.1, in a situation where the ring-buffer of a gadget is \u2013 incidentally or maliciously \u2013 already full, the gadget will silently drop events. The include/gadget/buffer.h file contains definitions for the Buffer API that gadgets can use to, among the other things, transfer data from eBPF programs to userspace. For hosts running a modern enough Linux kernel (>= 5.8), this transfer mechanism is based on ring-buffers. The size of the ring-buffer for the gadgets is hard-coded to 256KB. When a gadget_reserve_buf fails because of insufficient space, the gadget silently cleans up without producing an alert. The lost count reported by the eBPF operator, when using ring-buffers \u2013 the modern choice \u2013 is hardcoded to zero. The vulnerability can be used by a malicious event source (e.g. a compromised container) to cause a Denial Of Service, forcing the system to drop events coming from other containers (or the same container). This vulnerability is fixed in 0.50.1."}], "source": {"advisory": "GHSA-wv52-frfv-mfh4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-wv52-frfv-mfh4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T16:25:01.540633Z", "id": "CVE-2026-31890", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:25:05.936Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31890", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T16:25:01.540633Z"}}}], "references": [{"url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-wv52-frfv-mfh4", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:24:52.988Z"}}], "cna": {"title": "Inspektor Gadget: Tracing Denial of Service via Event Flooding", "source": {"advisory": "GHSA-wv52-frfv-mfh4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "inspektor-gadget", "product": "inspektor-gadget", "versions": [{"status": "affected", "version": "< 0.50.1"}]}], "references": [{"url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-wv52-frfv-mfh4", "name": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-wv52-frfv-mfh4", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. Prior to 0.50.1, in a situation where the ring-buffer of a gadget is \u2013 incidentally or maliciously \u2013 already full, the gadget will silently drop events. The include/gadget/buffer.h file contains definitions for the Buffer API that gadgets can use to, among the other things, transfer data from eBPF programs to userspace. For hosts running a modern enough Linux kernel (>= 5.8), this transfer mechanism is based on ring-buffers. The size of the ring-buffer for the gadgets is hard-coded to 256KB. When a gadget_reserve_buf fails because of insufficient space, the gadget silently cleans up without producing an alert. The lost count reported by the eBPF operator, when using ring-buffers \u2013 the modern choice \u2013 is hardcoded to zero. The vulnerability can be used by a malicious event source (e.g. a compromised container) to cause a Denial Of Service, forcing the system to drop events coming from other containers (or the same container). This vulnerability is fixed in 0.50.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-223", "description": "CWE-223: Omission of Security-relevant Information"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T17:35:02.129Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31890", "state": "PUBLISHED", "dateUpdated": "2026-03-13T16:25:05.936Z", "dateReserved": "2026-03-09T21:59:02.687Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-12T17:35:02.129Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "inspektor-gadget", "vendor": "inspektor-gadget", "versions": [{"status": "affected", "version": "< 0.50.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:inspektor_gadget:*:*:*:*:*:*:*:*", "matchCriteriaId": "852B8434-4B1D-445E-8FEC-A5B3C8F87560", "versionEndExcluding": "0.50.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. Prior to 0.50.1, in a situation where the ring-buffer of a gadget is \u2013 incidentally or maliciously \u2013 already full, the gadget will silently drop events. The include/gadget/buffer.h file contains definitions for the Buffer API that gadgets can use to, among the other things, transfer data from eBPF programs to userspace. For hosts running a modern enough Linux kernel (>= 5.8), this transfer mechanism is based on ring-buffers. The size of the ring-buffer for the gadgets is hard-coded to 256KB. When a gadget_reserve_buf fails because of insufficient space, the gadget silently cleans up without producing an alert. The lost count reported by the eBPF operator, when using ring-buffers \u2013 the modern choice \u2013 is hardcoded to zero. The vulnerability can be used by a malicious event source (e.g. a compromised container) to cause a Denial Of Service, forcing the system to drop events coming from other containers (or the same container). This vulnerability is fixed in 0.50.1."}, {"lang": "es", "value": "Inspektor Gadget es un conjunto de herramientas y framework para la recopilaci\u00f3n de datos y la inspecci\u00f3n del sistema en cl\u00fasteres de Kubernetes y hosts de Linux usando eBPF. Antes de la versi\u00f3n 0.50.1, en una situaci\u00f3n donde el b\u00fafer circular de un gadget est\u00e1 \u2013 incidental o maliciosamente \u2013 ya lleno, el gadget descartar\u00e1 eventos silenciosamente. El archivo include/gadget/buffer.h contiene definiciones para la API de b\u00fafer que los gadgets pueden usar para, entre otras cosas, transferir datos de programas eBPF al espacio de usuario. Para hosts que ejecutan un kernel de Linux lo suficientemente moderno (&gt;= 5.8), este mecanismo de transferencia se basa en b\u00faferes circulares. El tama\u00f1o del b\u00fafer circular para los gadgets est\u00e1 codificado a 256KB. Cuando un gadget_reserve_buf falla debido a espacio insuficiente, el gadget se limpia silenciosamente sin producir una alerta. El recuento de p\u00e9rdidas informado por el operador eBPF, cuando se usan b\u00faferes circulares \u2013 la opci\u00f3n moderna \u2013 est\u00e1 codificado a cero. La vulnerabilidad puede ser utilizada por una fuente de eventos maliciosa (por ejemplo, un contenedor comprometido) para causar una denegaci\u00f3n de servicio, forzando al sistema a descartar eventos provenientes de otros contenedores (o del mismo contenedor). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.50.1."}], "id": "CVE-2026-31890", "lastModified": "2026-06-17T10:34:42.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31890", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T16:25:01.540633Z", "version": "2.0.3"}}]}, "published": "2026-03-12T18:16:24.573", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-wv52-frfv-mfh4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/inspektor-gadget/inspektor-gadget/security/advisories/GHSA-wv52-frfv-mfh4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-223"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.50.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "inspektor-gadget", "source": "cna", "vendor": "inspektor-gadget"}, "product": "inspektor-gadget", "vendor": "inspektor-gadget"}], "analysis": {"en": {"generated_at": "2026-03-17T16:15:46.623135+00:00", "value": {"mitigation_remediation": ["Upgrade Inspektor Gadget to version 0.50.1 or later"], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected product is Inspektor Gadget (linuxfoundation:inspektor_gadget) running on Kubernetes clusters or Linux hosts that use a kernel version 5.8 or newer. All releases before 0.50.1 are vulnerable; no specific sub\u2011versions are enumerated in the advisory. The vulnerability originates in the buffer.h implementation that all supported gadgets use.", "description_and_impact": "Inspektor Gadget is a collection of tools that leverages eBPF to collect data from Kubernetes clusters and Linux hosts. Prior to release 0.50.1, the tracing gadgets use a fixed 256\u202fKB ring\u2011buffer to transport events from eBPF programs to user space. When the buffer is already full, the kernel ring\u2011buffer reservation fails and the gadget silently discards the event, resetting the lost\u2011event counter to zero. This behavior allows an attacker who can inject a large number of events\u2014such as from a compromised container\u2014to flood the ring\u2011buffer and cause the gadget to drop all subsequently generated events. The failure to surface loss causes operators to be unaware of the denial, effectively disabling observability (CWE\u2011223: Improper Error Handling, CWE\u2011770: Buffer Overflow).", "risk_and_exploitability": "CVSS 4.8 indicates moderate severity, and the EPSS score of less than 1\u202f% shows a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Successful exploitation requires an attacker to be able to generate a flood of eBPF events from within the cluster\u2014typically via a compromised container or untrusted pod\u2014providing local access to the host where the gadget runs. Attackers could then suppress monitoring and debugging output, potentially masking malicious activity."}}}}, "created": "2026-03-13T09:50:42.646195+00:00", "updated": "2026-03-20T15:48:43.539701+00:00", "vendors": ["inspektor-gadget", "inspektor-gadget$PRODUCT$inspektor-gadget"]}