{"id":"CVE-2019-11253","aliases":["BELL-CVE-2019-11253","DEBIAN-CVE-2019-11253","EUVD-2021-1151","GHSA-pmqp-h87c-mr78","GO-2022-0703","RHEA-2019:3809","RHSA-2019:3132","RHSA-2019:3239","RHSA-2019:3811","RHSA-2019:3905","RHSA-2020:2795","RHSA-2020:2796","RHSA-2020:2799","RHSA-2020:2861","RHSA-2020:2863","RHSA-2020:2870","openSUSE-SU-2024:10901-1","openSUSE-SU-2025:15424-1"],"status":"published","title":"Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack","description":"Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.25939,"percentile":0.97994,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-776"],"published":"2019-10-17T15:40:10Z","modified":"2026-10-24T10:47:38Z","exploits":[{"source":"nuclei","id":"CVE-2019-11253","title":"Kubernetes API Server - YAML Parsing DoS (Billion Laughs)","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11253.yaml"}],"fixes":[{"ecosystem":"Go","package":"k8s.io/kubernetes","fixed_in":["1.13.12","1.14.8","1.15.5","1.16.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"kubernetes","fixed_in":["1.17.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kubernetes","fixed_in":["1.17.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kubernetes","fixed_in":["1.17.4-1"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el7","package":"jaeger","fixed_in":["0:v1.13.1.redhat5-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el7","package":"jaeger-operator","fixed_in":["0:v1.13.1.redhat8-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el7","package":"kiali","fixed_in":["0:v1.0.7.redhat1-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh","fixed_in":["0:1.0.2-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-citadel","fixed_in":["0:1.0.2-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-cni","fixed_in":["0:1.0.2-3.el8","0:1.0.11-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-galley","fixed_in":["0:1.0.2-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-grafana","fixed_in":["0:6.2.2-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-grafana-prometheus","fixed_in":["0:6.2.2-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-istioctl","fixed_in":["0:1.0.2-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-mixc","fixed_in":["0:1.0.2-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-mixs","fixed_in":["0:1.0.2-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-operator","fixed_in":["0:1.0.2-7.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-pilot-agent","fixed_in":["0:1.0.2-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-pilot-discovery","fixed_in":["0:1.0.2-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-prometheus","fixed_in":["0:2.7.2-25.el8","0:2.7.2-36.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-proxy","fixed_in":["0:1.0.2-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-sidecar-injector","fixed_in":["0:1.0.2-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift","fixed_in":["0:4.1.20-201910101746.git.0.a80aad5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-clients","fixed_in":["0:4.1.20-201910101746.git.0.a80aad5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-clients-redistributable","fixed_in":["0:4.1.20-201910101746.git.0.a80aad5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-hyperkube","fixed_in":["0:4.1.20-201910101746.git.0.a80aad5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift","fixed_in":["0:4.1.20-201910101746.git.0.a80aad5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-clients","fixed_in":["0:4.1.20-201910101746.git.0.a80aad5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-clients-redistributable","fixed_in":["0:4.1.20-201910101746.git.0.a80aad5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-hyperkube","fixed_in":["0:4.1.20-201910101746.git.0.a80aad5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-cni","fixed_in":["0:1.1.4-2.el8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.13.12"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"1.14.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.4-1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.13.12"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.14.0"},{"fixed":"1.14.8"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.15.5"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.16.0"},{"fixed":"1.16.2"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.13.12"},{"introduced":"1.14.0"},{"fixed":"1.14.8"},{"introduced":"1.15.0"},{"fixed":"1.15.5"},{"introduced":"1.16.0"},{"fixed":"1.16.2"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el7","package":"jaeger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:v1.13.1.redhat5-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el7","package":"jaeger-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:v1.13.1.redhat8-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el7","package":"kiali","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:v1.0.7.redhat1-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-citadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-cni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-galley","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.2-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-grafana-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.2-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-istioctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-mixc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-mixs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-7.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-pilot-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-pilot-discovery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-25.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-sidecar-injector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.20-201910101746.git.0.a80aad5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.20-201910101746.git.0.a80aad5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.20-201910101746.git.0.a80aad5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.20-201910101746.git.0.a80aad5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.20-201910101746.git.0.a80aad5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.20-201910101746.git.0.a80aad5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.20-201910101746.git.0.a80aad5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.20-201910101746.git.0.a80aad5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.10::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.181-1.git.0.3ab4b3d.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.10::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.181-1.git.0.3ab4b3d.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.10::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.181-1.git.0.3ab4b3d.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.10::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.181-1.git.0.3ab4b3d.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.10::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.181-1.git.0.3ab4b3d.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.10::el7","package":"atomic-openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.181-1.git.0.3ab4b3d.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.10::el7","package":"atomic-openshift-hypershift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.181-1.git.0.3ab4b3d.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.10::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.181-1.git.0.3ab4b3d.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.10::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.181-1.git.0.3ab4b3d.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.10::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.181-1.git.0.3ab4b3d.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.10::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.181-1.git.0.3ab4b3d.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.10::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.181-1.git.0.3ab4b3d.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.10::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.181-1.git.0.3ab4b3d.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-cluster-capacity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-federation-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-service-catalog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.9::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.102-1.git.0.6411f52.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.154-1.git.0.7a097ad.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.154-1.git.0.7a097ad.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.154-1.git.0.7a097ad.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.154-1.git.0.7a097ad.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.154-1.git.0.7a097ad.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.154-1.git.0.7a097ad.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.154-1.git.0.7a097ad.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.154-1.git.0.7a097ad.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.154-1.git.0.7a097ad.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.154-1.git.0.7a097ad.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.154-1.git.0.7a097ad.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.154-1.git.0.7a097ad.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.154-1.git.0.7a097ad.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.3-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-grafana-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.3-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-cni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.4-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.2-38.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-grafana-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.2.2-38.el8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.2-36.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.0::el8","package":"servicemesh-cni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.11-1.el8"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250807T150727-1.1"}]}],"bundled":44}],"products":[{"vendor":"kubernetes","product":"kubernetes"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/83253","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Mitigation","Third Party Advisory","report","web"]},{"url":"https://groups.google.com/forum/#%21topic/kubernetes-security-announce/jk8polzSUxs","tags":["mailing-list","x_refsource_MLIST","x_transferred","Permissions Required","report"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3239","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20191031-0006/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3811","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3905","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11253","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes/pull/83261","tags":["web"]},{"url":"https://gist.github.com/bgeesaman/0e0349e94cd22c48bf14d8a9b7d6b8f2","tags":["web"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-security-announce/jk8polzSUxs","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0703","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20191031-0006","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pmqp-h87c-mr78","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-11253","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-11253","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHEA-2019:3809","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/MAISTRA-947","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhea-2019_3809.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11253","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757701","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11253","tags":["advisory"]},{"url":"https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3132","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3132.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1683190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1737651","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3239.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11249","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11249","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11249","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-security-discuss/Vf31dXp0EJc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1002100","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1002100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1002100","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-announce/vmUUNkYfG9g","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1753495","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3811.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10150","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10150","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10150","tags":["advisory"]},{"url":"https://docs.openshift.com/container-platform/3.11/dev_guide/builds/build_inputs.html#source-secrets-ssh-key-authentication","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11251","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11251","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/kubernetes-announce/YYtEFdFimZ4/nZnOezZuBgAJ","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3905.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2795","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850380","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2795.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14306","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14306","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2796","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1843640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1844228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848108","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848643","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2796.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16769","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16769","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16769","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7660","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7660","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7660","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7662","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7662","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7662","tags":["advisory"]},{"url":"https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12052","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12052","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12052","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12245","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12245","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12245","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13379","tags":["advisory"]},{"url":"https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2020/06/09/2/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13430","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13430","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13430","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2799","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2799.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2861","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2861.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2863","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2863.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2870","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2870.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1002101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1002105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11247","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1002102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1002100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1002101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1002100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1002101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-5321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47908","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-11253","title":"Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack","description":"Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.","status":"published","published":"2019-10-17T15:40:10.154Z","modified":"2024-09-16T23:21:47.959Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:32:22.432545Z"}],"euvd":[{"id":"EUVD-2021-1151","description":"Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.","status":"published","published":"2019-10-17T15:40:10Z","modified":"2024-09-16T23:21:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:54:54.099071Z"}],"ghsa":[{"id":"GHSA-pmqp-h87c-mr78","title":"XML Entity Expansion and Improper Input Validation in Kubernetes API server","description":"Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.\n\n### Specific Go Packages Affected\nk8s.io/kubernetes/pkg/apiserver","status":"published","published":"2021-05-18T15:38:48Z","modified":"2026-02-27T20:08:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-776"],"updated_at":"2026-11-02T14:39:28.962954Z"}],"nvd":[{"id":"CVE-2019-11253","description":"Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.","status":"published","published":"2019-10-17T16:15:10.443Z","modified":"2026-06-17T02:12:37.717Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-776"],"updated_at":"2026-11-02T14:05:31.860711Z"}],"osv":[{"id":"BELL-CVE-2019-11253","title":"CVE-2019-11253 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:08.34625Z","modified":"2026-01-26T09:49:00.317668Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2019-11253","description":"Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.","status":"published","published":"2019-10-17T16:15:10.443Z","modified":"2026-10-24T10:47:38.120354187Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-11253","description":"Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.","status":"published","published":"2019-10-17T16:15:10.443Z","modified":"2026-09-21T07:01:59.939571599Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"GHSA-pmqp-h87c-mr78","title":"XML Entity Expansion and Improper Input Validation in Kubernetes API server","description":"Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.\n\n### Specific Go Packages Affected\nk8s.io/kubernetes/pkg/apiserver","status":"published","published":"2021-05-18T15:38:48Z","modified":"2026-09-10T03:49:05.160246223Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-776"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"RHEA-2019:3809","title":"Red Hat Enhancement Advisory: Red Hat OpenShift Service Mesh 1.0.2 RPMs","status":"published","published":"2024-09-16T03:01:06Z","modified":"2026-06-27T10:06:43Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2019:3132","title":"Red Hat Security Advisory: OpenShift Container Platform 4.1.20 openshift security update","status":"published","published":"2024-09-16T03:00:43Z","modified":"2026-06-27T10:08:12Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:3239","title":"Red Hat Security Advisory: OpenShift Container Platform 3.10 atomic-openshift security update","status":"published","published":"2024-09-18T04:11:00Z","modified":"2026-06-27T10:08:19Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:3811","title":"Red Hat Security Advisory: OpenShift Container Platform 3.9 atomic-openshift security update","status":"published","published":"2024-09-16T03:01:08Z","modified":"2026-06-27T10:08:36Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2019:3905","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update","status":"published","published":"2024-09-16T03:01:13Z","modified":"2026-06-27T10:08:37Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:2795","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1 servicemesh-operator security update","status":"published","published":"2024-09-16T04:34:35Z","modified":"2026-06-27T10:10:36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2796","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update","status":"published","published":"2024-09-18T04:13:25Z","modified":"2026-10-13T10:01:44Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2799","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-cni security update","status":"published","published":"2024-09-16T03:01:19Z","modified":"2026-06-27T10:10:37Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2861","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-grafana security update","status":"published","published":"2024-09-18T04:14:08Z","modified":"2026-10-13T10:01:45Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2863","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-prometheus security update","status":"published","published":"2024-09-16T03:01:35Z","modified":"2026-06-27T10:10:42Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2870","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-cni security update","status":"published","published":"2024-09-16T03:00:43Z","modified":"2026-06-27T10:10:42Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"GO-2022-0703","title":"XML Entity Expansion and Improper Input Validation in Kubernetes API server in k8s.io/kubernetes","description":"XML Entity Expansion and Improper Input Validation in Kubernetes API server in k8s.io/kubernetes","status":"published","published":"2024-08-21T15:21:45Z","modified":"2026-02-04T02:27:31.453406Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"openSUSE-SU-2024:10901-1","title":"kubernetes-apiserver-1.22.2-21.2 on GA media","description":"These are all security issues fixed in the kubernetes-apiserver-1.22.2-21.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:04:48.070579Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2025:15424-1","title":"govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-08T00:00:00Z","modified":"2026-03-23T04:53:45.821911Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}