Description
In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | v1.0.x, v1.1.x, v1.2.x, v1.3.x, v1.4.x, v1.5.x, v1.6.x, v1.7.x, v1.8.x, v1.9.x, v1.10.x, unspecified – < v1.11.8, unspecified – < v1.12.6, unspecified – < v1.13.4 | v1.11.8 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.17.4-1 | — |
| Debian 13 | kubernetes | 1.17.4-1 | — |
| Debian 12 | kubernetes | 1.17.4-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift +12 | 3.10.181-1.git.0.3ab4b3d.el7 | RHSA-2019:3239, RHSA-2019:1851 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1560870549-1.el7 | RHSA-2019:1851 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.0.0, <= 1.10.14 | — | GHSA-q4rr-64r9-fwgf |
| Go | k8s.io/kubernetes | >= 1.11.0, < 1.11.8 | 1.11.8 | GHSA-q4rr-64r9-fwgf |
| Go | k8s.io/kubernetes | >= 1.12.0, < 1.12.6 | 1.12.6 | GHSA-q4rr-64r9-fwgf |
| Go | k8s.io/kubernetes | >= 1.13.0, < 1.13.4 | 1.13.4 | GHSA-q4rr-64r9-fwgf |
| Go | k8s.io/kubernetes | >= 1.0.0, < 1.11.8 · >= 1.12.0, < 1.12.6 · >= 1.13.0, < 1.13.4 | 1.11.8, 1.12.6, 1.13.4 | GO-2023-1946 |
Advisories 3
- RHSA-2019:3239 Red Hat Security Advisory: OpenShift Container Platform 3.10 atomic-openshift security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2019:1851 Red Hat Security Advisory: OpenShift Container Platform 3.11 security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026