CVE-2023-27484

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions an already highly privileged user able to create or update Compositions can specify an arbitrarily high index in a patch's `ToFieldPath`, which could lead to excessive memory usage once such Composition is selected for a Composite resource. Compositions allow users to specify patches inserting elements into arrays at an arbitrary index. When a Composition is selected for a Composite Resource, patches are evaluated and if a specified index is greater than the current size of the target slice, Crossplane will grow that slice up to the specified index, which could lead to an excessive amount of memory usage and therefore the Pod being OOM-Killed. The index is already capped to the maximum value for a uint32 (4294967295) when parsed, but that is still an unnecessarily large value. This issue has been addressed in versions 1.11.2, 1.10.3, and 1.9.2. Users are advised to upgrade. Users unable to upgrade can restrict write privileges on Compositions to only admin users as a workaround.

• CWE-20
• CWE-400
• CWE-400

• https://github.com/crossplane/crossplane/security/advisories/GHSA-v829-x6hh-cqfqVendor Advisory
• https://github.com/crossplane/crossplane/security/advisories/GHSA-v829-x6hh-cqfqVendor Advisory

Published

Mar 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27478libmemcached-awesome is an open source C/C++ client library …6.5
• CVE-2023-27479XWiki Platform is a generic wiki platform offering runtime s…9.9
• CVE-2023-27480XWiki Platform is a generic wiki platform offering runtime s…7.7
• CVE-2023-27481Directus is a real-time API and App dashboard for managing S…4.3
• CVE-2023-27482homeassistant is an open source home automation tool. A remo…10
• CVE-2023-27483crossplane-runtime is a set of go libraries used to build Ku…7.5
• CVE-2023-27485thmmniii/fbs-core is an open source feedback system for stud…4.3
• CVE-2023-27486xCAT is a toolkit for deployment and administration of compu…8.8
• CVE-2023-27487Envoy is an open source edge and service proxy designed for …9.1
• CVE-2023-27488Envoy is an open source edge and service proxy designed for …9.8
• CVE-2023-27489Kiwi TCMS is an open source test management system for both …5.4
• CVE-2023-2749Download Center fails to properly validate the file path sub…7.5