CVE-2025-32777 affects Volcano, a Kubernetes-native batch scheduling system, prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2. This vulnerability allows an attacker who has compromised either the Elastic service or an extender plugin to cause a denial of service (DoS) of the Volcano scheduler, leading to unrecoverable crashes or freezes due to excessive memory consumption. With a CVSS score of 8.2 (HIGH), the attack vector is network-based with high attack complexity, resulting in a complete loss of availability for the scheduler and other cluster users. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Volcano-Sh | Volcano | < 1.9.1, >= 1.10.0-alpha.0, < 1.10.2, >= 1.11.0, < 1.11.2, >= 1.11.0-network-topology-preview.0, < 1.11.0-network-topology-preview.3, >= 1.12.0-alpha.0, < 1.12.0-alpha.2CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.