Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-71469

Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-api pod, resulting in a Denial of Service (DoS).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

Default version status: affected

  • 1787689524 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13

Default version status: affected

  • 1787263804 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14

Default version status: affected

  • 1786723845 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

Default version status: affected

  • 1787238618 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16

Default version status: affected

  • 1787191668 to < *unaffected

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17

Default version status: affected

  • 1787229541 to < *unaffected

References