Kubernetes API Server denial of service vulnerability from malicious YAML payloads
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 2.4%
exploitation probability
2.4%top 18% of all CVEs
observed exploitation
nono source reports it
In short
The Kubernetes API Server can be made to consume excessive CPU resources when processing specially crafted YAML files, causing service slowdown or unavailability. An authorized user can exploit this to disrupt the cluster's management capabilities.
Technical detail
CVE-2019-11254 is a denial-of-service vulnerability in Kubernetes API Server (versions 1.1-1.14, and <1.15.10, <1.16.7, <1.17.3) triggered by malicious YAML payloads sent by authenticated users. The vulnerability stems from inefficient YAML parsing logic that allows crafted input to consume excessive CPU cycles, impacting API server availability and cluster operations.
Summary generated and translated by AI from the official description.
The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Kubernetes · Kubernetes