Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2019-11254

Kubernetes API Server denial of service vulnerability from malicious YAML payloads

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
kubernetes

Description

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kubernetes Kubernetes

  • prior to 1.15.10affected
  • prior to 1.16.7affected
  • prior to 1.17.3affected
  • 1.1affected
  • 1.2affected
  • 1.3affected
  • 1.4affected
  • 1.5affected
  • 1.6affected
  • 1.7affected
  • 1.8affected
  • 1.9affected
  • 1.10affected
  • 1.11affected
  • 1.12affected
  • 1.13affected
  • 1.14affected

References