CVE-2023-27483

CVE-2023-27483 is an out-of-memory panic vulnerability affecting crossplane-runtime, a Go library used in Crossplane and related Kubernetes controllers. Specifically, the Paved type's SetValue method, when processing unvalidated user input, can allocate excessive memory by growing arrays to extremely large indices, leading to a denial of service. This vulnerability carries a CVSS score of 7.5 (HIGH), indicating a network-exploitable issue with low attack complexity that can lead to a complete loss of availability (A:H). There is no authentication required, and no user interaction is needed for a successful attack. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules or proof-of-concept code. The vulnerability has received minimal community discussion and media coverage, suggesting a low level of public awareness or immediate threat.