{"id":"CVE-2022-39272","aliases":["ALPINE-CVE-2022-39272","BIT-flux-2022-39272","BIT-kustomize-2022-39272","EUVD-2022-7087","GHSA-f4p5-x4vc-mh4v","GO-2022-1071"],"status":"published","title":"Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration","description":"Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00788,"percentile":0.56513,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1284","CWE-20"],"published":"2022-10-19T18:40:02Z","modified":"2026-11-09T02:45:23Z","fixes":[{"ecosystem":"Go","package":"github.com/fluxcd/flux2","fixed_in":["0.35.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/fluxcd/source-controller","fixed_in":["0.30.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/fluxcd/kustomize-controller","fixed_in":["0.29.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/fluxcd/helm-controller","fixed_in":["0.24.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/fluxcd/notification-controller","fixed_in":["0.27.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/fluxcd/image-automation-controller","fixed_in":["0.26.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/fluxcd/image-reflector-controller","fixed_in":["0.22.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/fluxcd/helm-controller/api","fixed_in":["0.26.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/fluxcd/image-automation-controller/api","fixed_in":["0.26.1"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/fluxcd/image-reflector-controller/api","fixed_in":["0.22.1"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/fluxcd/kustomize-controller/api","fixed_in":["0.30.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/fluxcd/notification-controller/api","fixed_in":["0.28.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/fluxcd/source-controller/api","fixed_in":["0.30.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.21","package":"flux","fixed_in":["0.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"flux","fixed_in":["0.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"flux","fixed_in":["0.36.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"flux","fixed_in":["0.36.0-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"flux","fixed_in":["0.35.0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"kustomize","fixed_in":["0.29.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/fluxcd/flux2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.35.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/fluxcd/source-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1-alpha-1"},{"fixed":"0.30.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/fluxcd/kustomize-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1-alpha-1"},{"fixed":"0.29.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/fluxcd/helm-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1-alpha-1"},{"fixed":"0.24.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/fluxcd/notification-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1-alpha-1"},{"fixed":"0.27.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/fluxcd/image-automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.26.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/fluxcd/image-reflector-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"fixed":"0.22.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/fluxcd/helm-controller/api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/fluxcd/image-automation-controller/api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/fluxcd/image-reflector-controller/api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/fluxcd/kustomize-controller/api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/fluxcd/notification-controller/api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/fluxcd/source-controller/api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"flux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"flux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"flux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"flux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.36.0-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"flux","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"0.35.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"kustomize","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.2"},{"fixed":"0.29.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/flux2","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"0.35.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/source-controller","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.1-alpha-1"},{"fixed":"0.30.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/kustomize-controller","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.1-alpha-1"},{"fixed":"0.29.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/helm-controller","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.1-alpha-1"},{"fixed":"0.24.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/notification-controller","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.1-alpha-1"},{"fixed":"0.27.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/image-automation-controller","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"0.26.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/image-reflector-controller","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"0.22.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/helm-controller/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.26.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/image-automation-controller/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.26.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/image-reflector-controller/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.22.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/kustomize-controller/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.30.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/notification-controller/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.28.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/source-controller/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.30.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/helm-controller/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.26.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/image-automation-controller/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.26.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/image-reflector-controller/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.22.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/kustomize-controller/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.30.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/notification-controller/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.28.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fluxcd/source-controller/api","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.30.0"}]}]}],"products":[{"vendor":"fluxcd","product":"flux2"},{"vendor":"fluxcd","product":"helm-controller"},{"vendor":"fluxcd","product":"image-automation-controller"},{"vendor":"fluxcd","product":"image-reflector-controller"},{"vendor":"fluxcd","product":"kustomize-controller"},{"vendor":"fluxcd","product":"notification-controller"},{"vendor":"fluxcd","product":"source-controller"}],"references":[{"url":"https://github.com/fluxcd/flux2/security/advisories/GHSA-f4p5-x4vc-mh4v","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/kubernetes/apimachinery/issues/131","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39272","tags":["web","advisory"]},{"url":"https://github.com/fluxcd/helm-controller/pull/533","tags":["web","fix"]},{"url":"https://github.com/fluxcd/image-automation-controller/pull/439","tags":["web","fix"]},{"url":"https://github.com/fluxcd/image-reflector-controller/pull/314","tags":["web","fix"]},{"url":"https://github.com/fluxcd/kustomize-controller/pull/731","tags":["web","fix"]},{"url":"https://github.com/fluxcd/notification-controller/pull/420","tags":["web","fix"]},{"url":"https://github.com/fluxcd/source-controller/pull/903","tags":["web","fix"]},{"url":"https://github.com/kubernetes/apimachinery#131","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2022-1071","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f4p5-x4vc-mh4v","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-39272","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39272.json","tags":["advisory"]},{"url":"https://github.com/fluxcd/flux2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-39272","title":"Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration","description":"Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.","status":"published","published":"2022-10-21T00:00:00Z","modified":"2025-04-23T16:45:22.608Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-7087","description":"Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.","status":"published","published":"2022-10-21T00:00:00Z","modified":"2025-04-23T16:45:22Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:11.891054Z"}],"ghsa":[{"id":"GHSA-f4p5-x4vc-mh4v","title":"Improper use of metav1.Duration allows for Denial of Service","description":"Flux controllers within the affected versions range are vulnerable to a denial of service attack. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed.\n\nThe issue has two root causes: a) the Kubernetes type `metav1.Duration` not being fully compatible with the Go type `time.Duration` as explained on [upstream report](https://github.com/kubernetes/apimachinery/issues/131); b) lack of validation within Flux to restrict allowed values.\n\n### Workarounds\n\nAdmission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.\n\n### Credits\n\nThis issue was reported by Alexander Block (@codablock) through the Flux security mailing list (as [recommended](https://fluxcd.io/security/#report-a-vulnerability)).\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open an issue in any of the affected repositories.\n- Contact us at the CNCF Flux channel.\n\n### References\n\n- https://github.com/kubernetes/apimachinery/issues/131\n\n","status":"published","published":"2022-10-19T18:40:02Z","modified":"2024-05-20T21:35:11Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2022-39272","description":"Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.","status":"published","published":"2022-10-22T00:15:09.31Z","modified":"2026-06-17T04:58:02.757Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"ALPINE-CVE-2022-39272","description":"Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.","status":"published","published":"2022-10-22T00:15:09.31Z","modified":"2026-11-03T07:30:40.008132097Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"CVE-2022-39272","title":"Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration","description":"Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.","status":"published","published":"2022-10-21T00:00:00Z","modified":"2026-11-09T02:45:23.291107309Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1284"],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"GHSA-f4p5-x4vc-mh4v","title":"Improper use of metav1.Duration allows for Denial of Service","description":"Flux controllers within the affected versions range are vulnerable to a denial of service attack. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed.\n\nThe issue has two root causes: a) the Kubernetes type `metav1.Duration` not being fully compatible with the Go type `time.Duration` as explained on [upstream report](https://github.com/kubernetes/apimachinery/issues/131); b) lack of validation within Flux to restrict allowed values.\n\n### Workarounds\n\nAdmission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.\n\n### Credits\n\nThis issue was reported by Alexander Block (@codablock) through the Flux security mailing list (as [recommended](https://fluxcd.io/security/#report-a-vulnerability)).\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open an issue in any of the affected repositories.\n- Contact us at the CNCF Flux channel.\n\n### References\n\n- https://github.com/kubernetes/apimachinery/issues/131\n\n","status":"published","published":"2022-10-19T18:40:02Z","modified":"2026-09-10T03:49:46.466771528Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"BIT-flux-2022-39272","title":"Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration","description":"Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.","status":"published","published":"2025-12-02T17:37:01.043Z","modified":"2026-09-08T08:47:32.573795519Z","updated_at":"2026-11-02T15:28:29.999658Z"},{"id":"BIT-kustomize-2022-39272","title":"Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration","description":"Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.","status":"published","published":"2024-03-06T10:55:08.291Z","modified":"2026-09-08T08:48:08.023739295Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"GO-2022-1071","title":"Denial of service in flux controllers in github.com/fluxcd modules","description":"Flux controllers are vulnerable to a denial of service attack.\n\nUsers that have permissions to change Flux's objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interval or .spec.timeout (and structured variations of these fields), causing the entire object type to stop being processed.\n\nThe issue has two root causes: a) the Kubernetes type metav1.Duration is not fully compatible with the Go type time.Duration as explained in https://github.com/kubernetes/apimachinery/issues/131, and b) a lack of validation within Flux to restrict allowed values.","status":"published","published":"2022-10-28T16:07:05Z","modified":"2026-02-04T04:05:08.187843Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}