CVE-2025-32777: Volcano Batch Scheduler DoS Vulnerability

CVE-2025-32777 Overview

CVE-2025-32777 is a denial-of-service vulnerability in Volcano, a Kubernetes-native batch scheduling system. The flaw allows an attacker who has compromised the Elastic service or an extender plugin to crash or freeze the Volcano scheduler. Because Volcano deployments commonly run Elastic services and extender plugins in separate pods or nodes from the scheduler, exploitation crosses a Kubernetes node isolation boundary and constitutes a privilege escalation. Affected releases include all versions prior to 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2. The vulnerability is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact

Successful exploitation renders the Volcano scheduler unavailable to all cluster users and workloads. The scheduler either crashes with an unrecoverable out-of-memory (OOM) panic or freezes while consuming excessive memory.

Affected Products

• Volcano versions prior to 1.9.1
• Volcano versions prior to 1.10.2 and 1.11.2
• Volcano pre-release versions prior to 1.11.0-network-topology-preview.3 and 1.12.0-alpha.2

Discovery Timeline

• 2025-04-30 - CVE-2025-32777 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-32777

Vulnerability Analysis

Volcano is a Kubernetes-native batch scheduling system used in machine learning, high-performance computing, and data processing workloads. The scheduler relies on auxiliary components such as the Elastic service and extender plugins to make scheduling decisions. These components communicate scheduling input back to the scheduler over the network.

The vulnerability stems from missing resource limits on data accepted from these auxiliary components. When the scheduler ingests crafted or oversized payloads from a malicious Elastic service or extender plugin, memory consumption grows unbounded. The scheduler process either panics with an unrecoverable OOM condition or stalls under sustained memory pressure.

In Kubernetes, node isolation is a security boundary. Because Volcano administrators typically deploy these auxiliary components on separate pods or nodes, an attacker who compromises only the auxiliary surface should not be able to disrupt the scheduler. This flaw breaks that assumption.

Root Cause

The root cause is uncontrolled resource consumption [CWE-770] in the scheduler's processing of data received from the Elastic service and extender plugins. The scheduler does not enforce size, rate, or memory ceilings on inbound payloads before deserialization and processing.

Attack Vector

The attack vector is network-based and requires prior compromise of either the Elastic service, an extender plugin, or the pod or node hosting them. The attacker then sends crafted scheduling input that triggers excessive memory allocation in the scheduler. No authentication to the scheduler itself is required because trust is implicit between Volcano components.

No verified proof-of-concept code is publicly available. Refer to the GitHub Security Advisory GHSA-hg79-fw4p-25p8 for the maintainers' technical description.

Detection Methods for CVE-2025-32777

Indicators of Compromise

• Volcano scheduler pods restarting repeatedly with OOMKilled status in kubectl get pods -n volcano-system.
• Sudden spikes in scheduler memory consumption visible in cluster metrics or kubectl top pod.
• Pending Volcano jobs accumulating in the queue while the scheduler is unresponsive.
• Unexpected outbound payloads from Elastic service or extender plugin pods toward the scheduler service.

Detection Strategies

• Monitor scheduler pod restart counts and exit codes, alerting when the scheduler exits with code 137 (OOM) repeatedly.
• Baseline normal memory and CPU usage of the Volcano scheduler and trigger alerts on sustained deviations.
• Correlate scheduler unavailability with traffic originating from Elastic service or extender plugin pods using Kubernetes network flow logs.

Monitoring Recommendations

• Enable Kubernetes audit logging for the volcano-system namespace and forward to a centralized SIEM.
• Track scheduling latency and queue depth metrics exported by Volcano to detect scheduler stalls early.
• Implement runtime detection on the nodes hosting Elastic service and extender plugin pods to identify compromise of those components.

How to Mitigate CVE-2025-32777

Immediate Actions Required

• Upgrade Volcano to a patched release: 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, or 1.12.0-alpha.2.
• Audit which pods and nodes run the Elastic service and extender plugins, and confirm they are isolated from untrusted workloads.
• Review recent scheduler crashes and memory anomalies to determine whether exploitation has already occurred.

Patch Information

The Volcano maintainers released fixes in the following versions: v1.9.1, v1.10.2, v1.11.2, v1.11.0-network-topology-preview.3, and v1.12.0-alpha.2. Patch details are documented in GHSA-hg79-fw4p-25p8.

Workarounds

• Restrict network access to the Volcano scheduler using Kubernetes NetworkPolicy, permitting traffic only from trusted Elastic service and extender plugin pods.
• Apply strict resource limits and requests to the scheduler pod so OOM events are contained, while recognizing this does not prevent service disruption.
• Disable extender plugins and the Elastic service if they are not required by the cluster's workload profile.
• Run Elastic service and extender plugins on dedicated, hardened nodes with reduced exposure to untrusted workloads.

# Example: Restrict scheduler ingress to trusted Volcano components
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: volcano-scheduler-ingress
  namespace: volcano-system
spec:
  podSelector:
    matchLabels:
      app: volcano-scheduler
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: volcano-controllers
EOF