Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

knative/pkg

              main @ d2a153a
            

Fixes

CVEs

HIGH

Peak severity

75.0%

Coverage

Highlights

Denial of Service: 2 prior fixes. Scrutinize any change in this area.

metrics/resource_view.go: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Subresource update validation could be bypassed because the subresource context was not set correctly, allowing unauthorized operations to pass admission control.

Denial of Service: HTTP/2 enabled by default exposed the webhook to CVE-2023-44487 (Rapid Reset), enabling memory exhaustion and DoS.

Memory Leak DoS: An unbounded cache map (resourceToKey) could grow indefinitely, causing memory exhaustion and denial of service.