AIKIDO-2026-10151

TL;DR

Affected versions of this package are vulnerable to race-condition-driven finalizer handling issues where client-side updates to Kubernetes Update objects can conflict on resourceVersion, causing finalizers to remain orphaned and deletion to hang indefinitely. An attacker (or misbehaving controller) could exploit this by triggering rapid, concurrent Update and Delete operations, e.g., forcing TTL expirations or bulk deletes, so that finalizers are never removed, leading to persistent orphaned resources and a denial-of-service condition via resource exhaustion or stuck reconciliation loops.