Description
The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | unspecified – < v1.17.3, unspecified – < v1.16.7, unspecified – < v1.15.10 | v1.17.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.17.4-1 | — |
| Debian 13 | kubernetes | 1.17.4-1 | — |
| Debian 12 | kubernetes | 1.17.4-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | openshift +1 | 4.3.10-202003300855.git.0.da48c1d.el7 | RHSA-2020:1276 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.15.0, < 1.15.10 | 1.15.10 | GHSA-qhm4-jxv7-j9pq |
| Go | k8s.io/kubernetes | >= 1.16.0, < 1.16.6 | 1.16.6 | GHSA-qhm4-jxv7-j9pq |
| Go | k8s.io/kubernetes | >= 1.17.0, < 1.17.2 | 1.17.2 | GHSA-qhm4-jxv7-j9pq |
| Go | k8s.io/kubernetes | >= 1.15.0, < 1.15.10 · >= 1.16.0, < 1.16.6 · >= 1.17.0, < 1.17.2 | 1.15.10, 1.16.6, 1.17.2 | GO-2022-0867 |
Advisories 3
- WID-SEC-2022-0510 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2026
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- RHSA-2020:1276 Red Hat Security Advisory: OpenShift Container Platform 4.3.10 openshift security update Red Hat Security Advisories (RHSA) · Feb 24, 2026