GHSA-q4rr-64r9-fwgfMediumCVSS 6.5

Kubernetes DoS Vulnerability

Published
May 13, 2022
Last Modified
January 16, 2026

🔗 CVE IDs covered (1)

CVE-2019-1002100 →

📋 Description

In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. kubectl patch --type json or "Content-Type: application/json-patch+json") that consumes excessive resources while processing, causing a Denial of Service on the API Server.

🎯 Affected products4

  • go/k8s.io/kubernetes:>= 1.11.0, <= 1.11.7
  • go/k8s.io/kubernetes:>= 1.12.0, <= 1.12.5
  • go/k8s.io/kubernetes:>= 1.13.0, <= 1.13.3
  • go/k8s.io/kubernetes:>= 1.0.0, <= 1.10.14

🔗 References (8)