CVE-2019-11254

Published: Apr 1, 2020Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

Affected (3)

Products: Kubernetes: Kubernetes

Kubernetes

1 product

Kubernetes

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Kubernetes Kubernetes	Before 1.15.10
Kubernetes Kubernetes	From 1.16.0 to 1.16.7
Kubernetes Kubernetes	From 1.17.0 to 1.17.3

Related CWEs

CWE-1050

Excessive Platform Resource Consumption within a Loop

The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.

References (6)

https://github.com/kubernetes/kubernetes/issues/89535

Source: jordan@liggitt.net

Third Party Advisory

https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ

Source: jordan@liggitt.net

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200413-0003/

Source: jordan@liggitt.net

Third Party Advisory

https://github.com/kubernetes/kubernetes/issues/89535

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200413-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.