CVE-2026-118761

Prior to version 2.18.0 , Kubeflow Pipelines is vulnerable to a decompression bomb attack during pipeline archive uploads. The API server fails to adequately bound expanded data when decompressing ZIP or gzip-compressed tar archives, potentially allowing a small archive to consume excessive memor...