Every CVE Search/ Get API key

CVE-2024-0793

Kube-controller-manager: malformed hpa v1 manifest causes crash

7.7 HighFix available

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.59%Up 0.5 points since Nov 18, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.7

Kube-controller-manager: malformed hpa v1 manifest causes crash

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

Record
CVE-2024-0793
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2024-3260 7.7

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

Record
EUVD-2024-3260
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-h7wq-jj8r-qm7p 7.7

Kubernetes Nil pointer dereference in KCM after v1 HPA patch request

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

Record
GHSA-h7wq-jj8r-qm7p
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-20, CWE-476
Updated
2026-11-02
NVD 7.7

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

Record
CVE-2024-0793
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 7.7

Kube-controller-manager: malformed hpa v1 manifest causes crash

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

Record
CVE-2024-0793
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVGHSA-h7wq-jj8r-qm7p 7.7

Kubernetes Nil pointer dereference in KCM after v1 HPA patch request

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

Record
GHSA-h7wq-jj8r-qm7p
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weakness
CWE-20, CWE-476
Updated
2026-11-02
Show 16 moreShow less
OSVRHSA-2024:1267 7.7

Red Hat Security Advisory: OpenShift Container Platform 4.12.53 packages and security update

Record
RHSA-2024:1267
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Updated
2026-11-02
OSVGO-2024-3277 No score

Kubernetes Nil pointer dereference in KCM after v1 HPA patch request in k8s.io/kubernetes

Kubernetes Nil pointer dereference in KCM after v1 HPA patch request in k8s.io/kubernetes

Record
GO-2024-3277
Updated
2026-11-02
OSVopenSUSE-SU-2024:13715-1 No score

kubernetes1.23-apiserver-1.23.17-7.1 on GA media

These are all security issues fixed in the kubernetes1.23-apiserver-1.23.17-7.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13715-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13716-1 No score

kubernetes1.24-apiserver-1.24.17-3.1 on GA media

These are all security issues fixed in the kubernetes1.24-apiserver-1.24.17-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13716-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13717-1 No score

kubernetes1.25-apiserver-1.25.16-3.1 on GA media

These are all security issues fixed in the kubernetes1.25-apiserver-1.25.16-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13717-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13718-1 No score

kubernetes1.26-apiserver-1.26.14-1.1 on GA media

These are all security issues fixed in the kubernetes1.26-apiserver-1.26.14-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13718-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14513-1 No score

govulncheck-vulndb-0.0.20241119T173509-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20241119T173509-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14513-1
Updated
2026-11-02
OSVSUSE-SU-2024:1163-1 No score

Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues:

  • CVE-2024-0793: Fixed a DoS caused via a malformed HPA v1 manifest. (bsc#1219964)
Record
SUSE-SU-2024:1163-1
Updated
2026-11-02
OSVSUSE-SU-2024:1164-1 No score

Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues:

  • CVE-2024-0793: Fixed a DoS caused via a malformed HPA v1 manifest. (bsc#1219964)
Record
SUSE-SU-2024:1164-1
Updated
2026-11-02
OSVSUSE-SU-2024:1165-1 No score

Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues:

  • Upgrade from v1.25.14 to v1.25.16
  • CVE-2024-0793: Fixed a DoS caused via a malformed HPA v1 manifest. (bsc#1219964)
Record
SUSE-SU-2024:1165-1
Updated
2026-11-02
OSVSUSE-SU-2024:1166-1 No score

Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues:

  • Upgrade from v1.26.9 to v1.26.14
  • CVE-2024-0793: Fixed a DoS caused via a malformed HPA v1 manifest. (bsc#1219964)
Record
SUSE-SU-2024:1166-1
Updated
2026-11-02
OSVSUSE-SU-2024:1166-2 No score

Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues:

  • Upgrade from v1.26.9 to v1.26.14
  • CVE-2024-0793: Fixed a DoS caused via a malformed HPA v1 manifest. (bsc#1219964)
Record
SUSE-SU-2024:1166-2
Updated
2026-11-02
OSVSUSE-SU-2024:3341-1 No score

Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues:

  • CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized. (bsc#1194400)
  • CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
  • CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1211631)
  • CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets. (bsc#1229869)
  • CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
  • CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869)
  • CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests. (bsc#1219964)
  • CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1222539)
  • CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)

Bug fixes:

  • Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
  • Fix multiple issues for successful kubeadm init run. (bsc#1214406)
  • Update go to version 1.22.5 in build requirements. (bsc#1229858)
Record
SUSE-SU-2024:3341-1
Updated
2026-11-02
OSVSUSE-SU-2024:3343-1 No score

Security update for kubernetes1.24

This update for kubernetes1.24 fixes the following issues:

  • CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized. (bsc#1194400)
  • CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
  • CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1211631)
  • CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets. (bsc#1229869)
  • CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
  • CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. (bsc#1229869)
  • CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests. (bsc#1219964)
  • CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. (bsc#1222539)
  • CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)

Bug fixes:

  • Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
  • Fix multiple issues for successful kubeadm init run. (bsc#1214406)
  • Update go to version 1.22.5 in build requirements. (bsc#1229858)
Record
SUSE-SU-2024:3343-1
Updated
2026-11-02
OSVSUSE-SU-2025:02423-1 No score

Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues:

  • CVE-2021-25743: Escape terminal special characters in kubectl output (bsc#1194400).
  • CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement (bsc#1212493).
  • CVE-2024-0793: Advance autoscaling v2 as the preferred API version (bsc#1219964).
  • CVE-2024-3177: Prevent bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539).
  • CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content (bsc#1241865).
Record
SUSE-SU-2025:02423-1
Updated
2026-11-02
OSVSUSE-SU-2025:02423-2 No score

Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues:

  • CVE-2021-25743: Escape terminal special characters in kubectl output (bsc#1194400).
  • CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement (bsc#1212493).
  • CVE-2024-0793: Advance autoscaling v2 as the preferred API version (bsc#1219964).
  • CVE-2024-3177: Prevent bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (bsc#1222539).
  • CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content (bsc#1241865).
Record
SUSE-SU-2025:02423-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
k8s.io/kubernetes
Go
 before 1.27.0-alpha.1
1.27.0-alpha.1
openshift
Red Hat:openshift:4.12::el8
 before 0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el8
0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el8
openshift-hyperkube
Red Hat:openshift:4.12::el8
 before 0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el8
0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el8
openshift
Red Hat:openshift:4.12::el9
 before 0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el9
0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el9
openshift-hyperkube
Red Hat:openshift:4.12::el9
 before 0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el9
0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el9
kubernetes1.23
SUSE:Linux Enterprise Module for Containers 15 SP5
 before 1.23.17-150500.3.9.1
1.23.17-150500.3.9.1
kubernetes1.23
openSUSE:Leap 15.5
 before 1.23.17-150500.3.9.1
1.23.17-150500.3.9.1
kubernetes1.24
SUSE:Linux Enterprise Module for Containers 15 SP5
 before 1.24.17-150500.3.13.1
1.24.17-150500.3.13.1
kubernetes1.24
openSUSE:Leap 15.5
 before 1.24.17-150500.3.13.1
1.24.17-150500.3.13.1
kubernetes1.25
SUSE:Linux Enterprise Module for Containers 15 SP5
 before 1.25.16-150400.9.6.1
1.25.16-150400.9.6.1
Show 22 moreShow less
Affected packages
PackageAffectedFixed
kubernetes1.25
openSUSE:Leap 15.5
 before 1.25.16-150400.9.6.1
1.25.16-150400.9.6.1
kubernetes1.26
SUSE:Linux Enterprise Module for Containers 15 SP5
 before 1.26.14-150400.9.6.1
1.26.14-150400.9.6.1
kubernetes1.26
openSUSE:Leap 15.5
 before 1.26.14-150400.9.6.1
1.26.14-150400.9.6.1
kubernetes1.26
SUSE:Linux Enterprise Module for Containers 15 SP6
 before 1.26.14-150400.9.6.1
1.26.14-150400.9.6.1
kubernetes1.24
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 9 CVEs
 before 1.24.17-150400.9.16.1
1.24.17-150400.9.16.1
kubernetes1.24
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 9 CVEs
 before 1.24.17-150400.9.16.1
1.24.17-150400.9.16.1
kubernetes1.24
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 9 CVEs
 before 1.24.17-150400.9.16.1
1.24.17-150400.9.16.1
kubernetes1.24
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 9 CVEs
 before 1.24.17-150400.9.16.1
1.24.17-150400.9.16.1
kubernetes1.24
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 9 CVEs
 before 1.24.17-150300.7.6.1
1.24.17-150300.7.6.1
kubernetes1.24
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 9 CVEs
 before 1.24.17-150300.7.6.1
1.24.17-150300.7.6.1
kubernetes1.24
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 9 CVEs
 before 1.24.17-150300.7.6.1
1.24.17-150300.7.6.1
kubernetes1.24
SUSE:Enterprise Storage 7.1
From an advisory covering 9 CVEs
 before 1.24.17-150300.7.6.1
1.24.17-150300.7.6.1
kubernetes1.23
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.23
SUSE:Enterprise Storage 7.1
From an advisory covering 5 CVEs
 before 1.23.17-150300.7.12.1
1.23.17-150300.7.12.1
kubernetes1.26
openSUSE:Tumbleweed
 before 1.26.14-1.1
1.26.14-1.1
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 10 CVEs
 before 0.0.20241119T173509-1.1
0.0.20241119T173509-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-0793 is a high vulnerability (CVSS 7.7) in Red Hat Openshift Container Platform 4, published April 8, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in k8s.io/kubernetes 1.27.0-alpha.1.

References

Show 59 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open