Description
Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | prior to 1.13.12, prior to 1.14.8, prior to 1.15.5, prior to 1.16.2, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.17.4-1 | — |
| Debian 13 | kubernetes | 1.17.4-1 | — |
| Debian 12 | kubernetes | 1.17.4-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | jaeger | v1.13.1.redhat5-1.el7 | RHEA-2019:3809 |
| Red Hat Service Mesh 1 | jaeger-operator | v1.13.1.redhat8-1.el7 | RHEA-2019:3809 |
| Red Hat Service Mesh 1 | kiali | v1.0.7.redhat1-1.el7 | RHEA-2019:3809 |
| Red Hat Service Mesh 1 | servicemesh +10 | 1.0.2-3.el8 | RHSA-2020:2870, RHSA-2020:2799, RHEA-2019:3809 |
| Red Hat Service Mesh 1 | servicemesh-grafana +1 | 6.2.2-24.el8 | RHSA-2020:2861, RHSA-2020:2796, RHEA-2019:3809 |
| Red Hat Service Mesh 1 | servicemesh-operator | 1.0.2-7.el8 | RHSA-2020:2795, RHEA-2019:3809 |
| Red Hat Service Mesh 1 | servicemesh-prometheus | 2.7.2-25.el8 | RHSA-2020:2863, RHEA-2019:3809 |
| Red Hat OpenShift 4 | openshift +3 | 4.1.20-201910101746.git.0.a80aad5.el7 | RHSA-2019:3132 |
| Red Hat OpenShift 3 | atomic-openshift +13 | 3.9.102-1.git.0.6411f52.el7 | RHSA-2019:3905, RHSA-2019:3811, RHSA-2019:3239 |
| Red Hat OpenShift 3 | atomic-openshift-hyperkube +1 | 3.10.181-1.git.0.3ab4b3d.el7 | RHSA-2019:3905, RHSA-2019:3239 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | containerd | 1.3.3-r0 | — |
| Alpine v3.23 | containerd | 1.3.3-r0 | — |
| Alpine v3.22 | containerd | 1.3.3-r0 | — |
| Alpine v3.21 | containerd | 1.3.3-r0 | — |
| Alpine v3.20 | containerd | 1.3.3-r0 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | containerd | 1.3.3-r0 | — |
| Alpine v3.18 | containerd | 1.3.3-r0 | — |
| Alpine v3.17 | containerd | 1.3.3-r0 | — |
| Alpine v3.16 | containerd | 1.3.3-r0 | — |
| Alpine v3.15 | containerd | 1.3.3-r0 | — |
| Alpine v3.14 | containerd | 1.3.3-r0 | — |
| Alpine v3.13 | containerd | 1.3.3-r0 | — |
| Alpine v3.12 | containerd | 1.3.3-r0 | — |
| Alpine v3.11 | containerd | 1.3.3-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | kubeadm +2 | 1.12.10-1.0.10.el7 | ELSA-2019-4816 |
| Oracle Linux 7 | kubeadm-ha-setup | 0.0.2-1.0.68.el7 | ELSA-2019-4816 |
| Oracle Linux 7 | kubeadm-upgrade | 0.0.1-1.0.27.el7 | ELSA-2019-4816 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Kubernetes API Server - YAML Parsing DoS (Billion Laughs) http/cves/2019/CVE-2019-11253.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.0.0, < 1.13.12 | 1.13.12 | GHSA-pmqp-h87c-mr78 |
| Go | k8s.io/kubernetes | >= 1.14.0, < 1.14.8 | 1.14.8 | GHSA-pmqp-h87c-mr78 |
| Go | k8s.io/kubernetes | >= 1.15.0, < 1.15.5 | 1.15.5 | GHSA-pmqp-h87c-mr78 |
| Go | k8s.io/kubernetes | >= 1.16.0, < 1.16.2 | 1.16.2 | GHSA-pmqp-h87c-mr78 |
| Go | k8s.io/kubernetes | >= 1.0.0, < 1.13.12 · >= 1.14.0, < 1.14.8 · >= 1.15.0, < 1.15.5 · >= 1.16.0, < 1.16.2 | 1.13.12, 1.14.8, 1.15.5, 1.16.2 | GO-2022-0703 |
Advisories 16
- RHSA-2020:2861 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-grafana security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:2796 Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:2863 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-prometheus security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:2870 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-cni security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:2799 Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-cni security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:2795 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1 servicemesh-operator security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2019:3905 Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2019:3811 Red Hat Security Advisory: OpenShift Container Platform 3.9 atomic-openshift security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2019:3239 Red Hat Security Advisory: OpenShift Container Platform 3.10 atomic-openshift security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2019:3132 Red Hat Security Advisory: OpenShift Container Platform 4.1.20 openshift security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHEA-2019:3809 Red Hat Enhancement Advisory: Red Hat OpenShift Service Mesh 1.0.2 RPMs Red Hat Security Advisories (RHSA) · Jun 27, 2026
- WID-SEC-2022-0510 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2026
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2026-0777 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 18, 2026
- WID-SEC-2025-0653 Kubernetes: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Mar 30, 2025
- ELSA-2019-4816 Important: kubernetes security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 31, 2020
References
- https://github.com/kubernetes/kubernetes/issues/83253
- CVE-2019-11253: denial of service vulnerability from malicious YAML or JSON payloads mailing-list
- RHSA-2019:3239 vendor-advisory
- https://security.netapp.com/advisory/ntap-20191031-0006/
- RHSA-2019:3811 vendor-advisory
- RHSA-2019:3905 vendor-advisory