CVE-2019-11254mediumCWE-1050

CVE-2019-11254: medium-severity vulnerability in Kubernetes

Kubernetes API Server denial of service vulnerability from malicious YAML payloads

Published · Updated

Follow this CVE+ Monitor Kubernetes+ Monitor kubernetes

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 3.2%
In short

The Kubernetes API Server can be made to consume excessive CPU resources when processing specially crafted YAML files, causing service slowdown or unavailability. An authorized user can exploit this to disrupt the cluster's management capabilities.

Technical detail

CVE-2019-11254 is a denial-of-service vulnerability in Kubernetes API Server (versions 1.1-1.14, and <1.15.10, <1.16.7, <1.17.3) triggered by malicious YAML payloads sent by authenticated users. The vulnerability stems from inefficient YAML parsing logic that allows crafted input to consume excessive CPU cycles, impacting API server availability and cluster operations.

Summary generated and translated by AI from the official description.
The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Kubernetes · Kubernetes
Related CVEs — Kubernetes

In the same product, most dangerous first.

CVE-2018-1002105CRITICALCVE-2018-1002105EPSS 87.0%CVE-2019-11248MEDIUMKubernetes kubelet exposes /debug/pprof info on healthz portEPSS 75.1%CVE-2019-11253HIGHKubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attackEPSS 25.9%CVE-2019-1002100MEDIUMCVE-2019-1002100EPSS 16.9%CVE-2017-1002101HIGHCVE-2017-1002101EPSS 13.3%CVE-2019-1002101MEDIUMkubectl cp path traversalEPSS 12.8%