CVE-2019-11253

Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack

7.5 HighFix available

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

25.9%Up 24.5 points since Apr 14, 2021

What each source reports

CVE List Score used 7.5

Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack

Record: CVE-2019-11253
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-20
Updated: 2026-11-02

EUVDEUVD-2021-1151 7.5

Record: EUVD-2021-1151
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pmqp-h87c-mr78 7.5

XML Entity Expansion and Improper Input Validation in Kubernetes API server

Specific Go Packages Affected

k8s.io/kubernetes/pkg/apiserver

Record: GHSA-pmqp-h87c-mr78
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-20, CWE-776
Updated: 2026-11-02

NVD 7.5

Record: CVE-2019-11253
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-20, CWE-776
Updated: 2026-11-02

OSVBELL-CVE-2019-11253 7.5

CVE-2019-11253 does not affect BellSoft software

Record: BELL-CVE-2019-11253
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.5

Record: CVE-2019-11253
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 16 moreShow less

OSVDEBIAN-CVE-2019-11253 7.5

Record: DEBIAN-CVE-2019-11253
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-pmqp-h87c-mr78 7.5

XML Entity Expansion and Improper Input Validation in Kubernetes API server

Specific Go Packages Affected

k8s.io/kubernetes/pkg/apiserver

Record: GHSA-pmqp-h87c-mr78
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-20, CWE-776
Updated: 2026-11-02

OSVRHEA-2019:3809 7.5

Red Hat Enhancement Advisory: Red Hat OpenShift Service Mesh 1.0.2 RPMs

Record: RHEA-2019:3809
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2019:3132 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.1.20 openshift security update

Record: RHSA-2019:3132
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2019:3239 7.5

Red Hat Security Advisory: OpenShift Container Platform 3.10 atomic-openshift security update

Record: RHSA-2019:3239
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2019:3811 7.5

Red Hat Security Advisory: OpenShift Container Platform 3.9 atomic-openshift security update

Record: RHSA-2019:3811
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2019:3905 7.5

Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update

Record: RHSA-2019:3905
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2020:2795 8.8

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1 servicemesh-operator security update

Record: RHSA-2020:2795
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2020:2796 8.2

Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update

Record: RHSA-2020:2796
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2020:2799 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-cni security update

Record: RHSA-2020:2799
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2020:2861 8.2

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-grafana security update

Record: RHSA-2020:2861
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2020:2863 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-prometheus security update

Record: RHSA-2020:2863
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2020:2870 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-cni security update

Record: RHSA-2020:2870
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGO-2022-0703 No score

XML Entity Expansion and Improper Input Validation in Kubernetes API server in k8s.io/kubernetes

XML Entity Expansion and Improper Input Validation in Kubernetes API server in k8s.io/kubernetes

Record: GO-2022-0703
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10901-1 No score

kubernetes-apiserver-1.22.2-21.2 on GA media

These are all security issues fixed in the kubernetes-apiserver-1.22.2-21.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10901-1
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15424-1 No score

govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15424-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`k8s.io/kubernetes` Go	1.0.0 up to 1.13.12	1.13.12
`k8s.io/kubernetes` Go	1.14.0 up to 1.14.8	1.14.8
`k8s.io/kubernetes` Go	1.15.0 up to 1.15.5	1.15.5
`k8s.io/kubernetes` Go	1.16.0 up to 1.16.2	1.16.2
`kubernetes` Debian:12	before 1.17.4-1	1.17.4-1
`kubernetes` Debian:13	before 1.17.4-1	1.17.4-1
`kubernetes` Debian:14	before 1.17.4-1	1.17.4-1
`k8s.io/kubernetes` Go	1.0.0 up to 1.13.12, 1.14.0 up to 1.14.8, 1.15.0 up to 1.15.5, 1.16.0 up to 1.16.2	1.13.121.14.81.15.51.16.2
`jaeger` Red Hat:service_mesh:1.0::el7	before 0:v1.13.1.redhat5-1.el7	0:v1.13.1.redhat5-1.el7
`jaeger-operator` Red Hat:service_mesh:1.0::el7	before 0:v1.13.1.redhat8-1.el7	0:v1.13.1.redhat8-1.el7

Show 73 moreShow less

Affected packages
Package	Affected	Fixed
`kiali` Red Hat:service_mesh:1.0::el7	before 0:v1.0.7.redhat1-1.el7	0:v1.0.7.redhat1-1.el7
`servicemesh` Red Hat:service_mesh:1.0::el8	before 0:1.0.2-3.el8	0:1.0.2-3.el8
`servicemesh-citadel` Red Hat:service_mesh:1.0::el8	before 0:1.0.2-3.el8	0:1.0.2-3.el8
`servicemesh-cni` Red Hat:service_mesh:1.0::el8	before 0:1.0.2-3.el8	0:1.0.2-3.el8
`servicemesh-galley` Red Hat:service_mesh:1.0::el8	before 0:1.0.2-3.el8	0:1.0.2-3.el8
`servicemesh-grafana` Red Hat:service_mesh:1.0::el8	before 0:6.2.2-24.el8	0:6.2.2-24.el8
`servicemesh-grafana-prometheus` Red Hat:service_mesh:1.0::el8	before 0:6.2.2-24.el8	0:6.2.2-24.el8
`servicemesh-istioctl` Red Hat:service_mesh:1.0::el8	before 0:1.0.2-3.el8	0:1.0.2-3.el8
`servicemesh-mixc` Red Hat:service_mesh:1.0::el8	before 0:1.0.2-3.el8	0:1.0.2-3.el8
`servicemesh-mixs` Red Hat:service_mesh:1.0::el8	before 0:1.0.2-3.el8	0:1.0.2-3.el8
`servicemesh-operator` Red Hat:service_mesh:1.0::el8	before 0:1.0.2-7.el8	0:1.0.2-7.el8
`servicemesh-pilot-agent` Red Hat:service_mesh:1.0::el8	before 0:1.0.2-3.el8	0:1.0.2-3.el8
`servicemesh-pilot-discovery` Red Hat:service_mesh:1.0::el8	before 0:1.0.2-3.el8	0:1.0.2-3.el8
`servicemesh-prometheus` Red Hat:service_mesh:1.0::el8	before 0:2.7.2-25.el8	0:2.7.2-25.el8
`servicemesh-proxy` Red Hat:service_mesh:1.0::el8	before 0:1.0.2-3.el8	0:1.0.2-3.el8
`servicemesh-sidecar-injector` Red Hat:service_mesh:1.0::el8	before 0:1.0.2-3.el8	0:1.0.2-3.el8
`openshift` Red Hat:openshift:4.1::el7	before 0:4.1.20-201910101746.git.0.a80aad5.el7	0:4.1.20-201910101746.git.0.a80aad5.el7
`openshift-clients` Red Hat:openshift:4.1::el7	before 0:4.1.20-201910101746.git.0.a80aad5.el7	0:4.1.20-201910101746.git.0.a80aad5.el7
`openshift-clients-redistributable` Red Hat:openshift:4.1::el7	before 0:4.1.20-201910101746.git.0.a80aad5.el7	0:4.1.20-201910101746.git.0.a80aad5.el7
`openshift-hyperkube` Red Hat:openshift:4.1::el7	before 0:4.1.20-201910101746.git.0.a80aad5.el7	0:4.1.20-201910101746.git.0.a80aad5.el7
`openshift` Red Hat:openshift:4.1::el8	before 0:4.1.20-201910101746.git.0.a80aad5.el8	0:4.1.20-201910101746.git.0.a80aad5.el8
`openshift-clients` Red Hat:openshift:4.1::el8	before 0:4.1.20-201910101746.git.0.a80aad5.el8	0:4.1.20-201910101746.git.0.a80aad5.el8
`openshift-clients-redistributable` Red Hat:openshift:4.1::el8	before 0:4.1.20-201910101746.git.0.a80aad5.el8	0:4.1.20-201910101746.git.0.a80aad5.el8
`openshift-hyperkube` Red Hat:openshift:4.1::el8	before 0:4.1.20-201910101746.git.0.a80aad5.el8	0:4.1.20-201910101746.git.0.a80aad5.el8
`atomic-openshift` Red Hat:openshift:3.10::el7	before 0:3.10.181-1.git.0.3ab4b3d.el7	0:3.10.181-1.git.0.3ab4b3d.el7
`atomic-openshift-clients` Red Hat:openshift:3.10::el7	before 0:3.10.181-1.git.0.3ab4b3d.el7	0:3.10.181-1.git.0.3ab4b3d.el7
`atomic-openshift-clients-redistributable` Red Hat:openshift:3.10::el7	before 0:3.10.181-1.git.0.3ab4b3d.el7	0:3.10.181-1.git.0.3ab4b3d.el7
`atomic-openshift-docker-excluder` Red Hat:openshift:3.10::el7	before 0:3.10.181-1.git.0.3ab4b3d.el7	0:3.10.181-1.git.0.3ab4b3d.el7
`atomic-openshift-excluder` Red Hat:openshift:3.10::el7	before 0:3.10.181-1.git.0.3ab4b3d.el7	0:3.10.181-1.git.0.3ab4b3d.el7
`atomic-openshift-hyperkube` Red Hat:openshift:3.10::el7	before 0:3.10.181-1.git.0.3ab4b3d.el7	0:3.10.181-1.git.0.3ab4b3d.el7
`atomic-openshift-hypershift` Red Hat:openshift:3.10::el7	before 0:3.10.181-1.git.0.3ab4b3d.el7	0:3.10.181-1.git.0.3ab4b3d.el7
`atomic-openshift-master` Red Hat:openshift:3.10::el7	before 0:3.10.181-1.git.0.3ab4b3d.el7	0:3.10.181-1.git.0.3ab4b3d.el7
`atomic-openshift-node` Red Hat:openshift:3.10::el7	before 0:3.10.181-1.git.0.3ab4b3d.el7	0:3.10.181-1.git.0.3ab4b3d.el7
`atomic-openshift-pod` Red Hat:openshift:3.10::el7	before 0:3.10.181-1.git.0.3ab4b3d.el7	0:3.10.181-1.git.0.3ab4b3d.el7
`atomic-openshift-sdn-ovs` Red Hat:openshift:3.10::el7	before 0:3.10.181-1.git.0.3ab4b3d.el7	0:3.10.181-1.git.0.3ab4b3d.el7
`atomic-openshift-template-service-broker` Red Hat:openshift:3.10::el7	before 0:3.10.181-1.git.0.3ab4b3d.el7	0:3.10.181-1.git.0.3ab4b3d.el7
`atomic-openshift-tests` Red Hat:openshift:3.10::el7	before 0:3.10.181-1.git.0.3ab4b3d.el7	0:3.10.181-1.git.0.3ab4b3d.el7
`atomic-openshift` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift-clients` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift-clients-redistributable` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift-cluster-capacity` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift-docker-excluder` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift-excluder` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift-federation-services` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift-master` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift-node` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift-pod` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift-sdn-ovs` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift-service-catalog` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift-template-service-broker` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift-tests` Red Hat:openshift:3.9::el7	before 0:3.9.102-1.git.0.6411f52.el7	0:3.9.102-1.git.0.6411f52.el7
`atomic-openshift` Red Hat:openshift:3.11::el7	before 0:3.11.154-1.git.0.7a097ad.el7	0:3.11.154-1.git.0.7a097ad.el7
`atomic-openshift-clients` Red Hat:openshift:3.11::el7	before 0:3.11.154-1.git.0.7a097ad.el7	0:3.11.154-1.git.0.7a097ad.el7
`atomic-openshift-clients-redistributable` Red Hat:openshift:3.11::el7	before 0:3.11.154-1.git.0.7a097ad.el7	0:3.11.154-1.git.0.7a097ad.el7
`atomic-openshift-docker-excluder` Red Hat:openshift:3.11::el7	before 0:3.11.154-1.git.0.7a097ad.el7	0:3.11.154-1.git.0.7a097ad.el7
`atomic-openshift-excluder` Red Hat:openshift:3.11::el7	before 0:3.11.154-1.git.0.7a097ad.el7	0:3.11.154-1.git.0.7a097ad.el7
`atomic-openshift-hyperkube` Red Hat:openshift:3.11::el7	before 0:3.11.154-1.git.0.7a097ad.el7	0:3.11.154-1.git.0.7a097ad.el7
`atomic-openshift-hypershift` Red Hat:openshift:3.11::el7	before 0:3.11.154-1.git.0.7a097ad.el7	0:3.11.154-1.git.0.7a097ad.el7
`atomic-openshift-master` Red Hat:openshift:3.11::el7	before 0:3.11.154-1.git.0.7a097ad.el7	0:3.11.154-1.git.0.7a097ad.el7
`atomic-openshift-node` Red Hat:openshift:3.11::el7	before 0:3.11.154-1.git.0.7a097ad.el7	0:3.11.154-1.git.0.7a097ad.el7
`atomic-openshift-pod` Red Hat:openshift:3.11::el7	before 0:3.11.154-1.git.0.7a097ad.el7	0:3.11.154-1.git.0.7a097ad.el7
`atomic-openshift-sdn-ovs` Red Hat:openshift:3.11::el7	before 0:3.11.154-1.git.0.7a097ad.el7	0:3.11.154-1.git.0.7a097ad.el7
`atomic-openshift-template-service-broker` Red Hat:openshift:3.11::el7	before 0:3.11.154-1.git.0.7a097ad.el7	0:3.11.154-1.git.0.7a097ad.el7
`atomic-openshift-tests` Red Hat:openshift:3.11::el7	before 0:3.11.154-1.git.0.7a097ad.el7	0:3.11.154-1.git.0.7a097ad.el7
`servicemesh-operator` Red Hat:service_mesh:1.1::el8	before 0:1.1.4-3.el8	0:1.1.4-3.el8
`servicemesh-grafana` Red Hat:service_mesh:1.1::el8	before 0:6.4.3-11.el8	0:6.4.3-11.el8
`servicemesh-grafana-prometheus` Red Hat:service_mesh:1.1::el8	before 0:6.4.3-11.el8	0:6.4.3-11.el8
`servicemesh-cni` Red Hat:service_mesh:1.1::el8	before 0:1.1.4-2.el8	0:1.1.4-2.el8
`servicemesh-grafana` Red Hat:service_mesh:1.0::el8	before 0:6.2.2-38.el8	0:6.2.2-38.el8
`servicemesh-grafana-prometheus` Red Hat:service_mesh:1.0::el8	before 0:6.2.2-38.el8	0:6.2.2-38.el8
`servicemesh-prometheus` Red Hat:service_mesh:1.0::el8	before 0:2.7.2-36.el8	0:2.7.2-36.el8
`servicemesh-cni` Red Hat:service_mesh:1.0::el8	before 0:1.0.11-1.el8	0:1.0.11-1.el8
`govulncheck-vulndb` openSUSE:Tumbleweed	before 0.0.20250807T150727-1.1	0.0.20250807T150727-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	Kubernetes API Server - YAML Parsing DoS (Billion Laughs)

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11253 is a high vulnerability (CVSS 7.5) in Kubernetes, published October 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 25.9%, the 97th percentile. Fixed in k8s.io/kubernetes 1.13.12.

References

Show 135 moreShow less