Description
A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | kubelet | 1.32.0 – ≤ 1.32.1, 1.31.0 – ≤ 1.31.5, 1.30.0 – ≤ 1.30.9 | 1.32.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.20.5+really1.20.2-1 | — |
| Debian 13 | kubernetes | 1.20.5+really1.20.2-1 | — |
| Debian 12 | kubernetes | 1.20.5+really1.20.2-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250312T181707-1.1 | openSUSE-SU-2025:14889-1 |
| openSUSE Tumbleweed | kubernetes1.29 | 1.29.14-1.1 | openSUSE-SU-2025:14816-1 |
| openSUSE Tumbleweed | kubernetes1.30 | 1.30.10-1.1 | openSUSE-SU-2025:14817-1 |
| openSUSE Tumbleweed | kubernetes1.31 | 1.31.6-1.1 | openSUSE-SU-2025:14818-1 |
| openSUSE Tumbleweed | kubernetes1.32 | 1.32.2-1.1 | openSUSE-SU-2025:14819-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20251230T014957-150000.1.134.1 | SUSE-SU-2026:0037-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.21 | kubernetes | 1.31.5-r0 | — |
| Alpine v3.20 | kubernetes | 1.30.9-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kubernetes | 1.30.10-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-rollouts +1 | 1.8.0-r2 | — |
| Wolfi rolling | argocd-image-updater | 0.17.0-r1 | — |
| Wolfi rolling | aws-efs-csi-driver | 2.1.7-r0 | — |
| Wolfi rolling | emissary | 3.10.0-r12 | — |
| Wolfi rolling | ip-masq-agent | 2.12.0-r5 | — |
| Wolfi rolling | kapp | 0.64.0-r4 | — |
| Wolfi rolling | kubectl-1.27 +5 | No fix yet | — |
| Wolfi rolling | kubectl-1.30 +2 | 1.30.10-r0 | — |
| Wolfi rolling | kubectl-1.31 +1 | 1.31.6-r0 | — |
| Wolfi rolling | kubectl-1.32 +1 | 1.32.2-r0 | — |
| Wolfi rolling | kubernetes-csi-driver-hostpath | 1.15.0-r6 | — |
| Wolfi rolling | kubernetes-csi-driver-nfs | 4.12.1-r1 | — |
| Wolfi rolling | kubernetes-dns-node-cache | 1.25.0-r2 | — |
| Wolfi rolling | local-static-provisioner +3 | 2.7.0-r13 | — |
| Wolfi rolling | nodetaint | 0.0.4-r28 | — |
| Wolfi rolling | rancher-fleet +4 | 0.11.3-r3 | — |
| Wolfi rolling | spark-operator +1 | 2.1.0-r6 | — |
| Wolfi rolling | vcluster +2 | 0.26.0-r1 | — |
| Wolfi rolling | yunikorn-k8shim | 1.6.1-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.32.0, < 1.32.2 | 1.32.2 | GHSA-jgfp-53c3-624w |
| Go | k8s.io/kubernetes | >= 1.31.0, < 1.31.6 | 1.31.6 | GHSA-jgfp-53c3-624w |
| Go | k8s.io/kubernetes | >= 1.30.0, < 1.30.10 | 1.30.10 | GHSA-jgfp-53c3-624w |
| Go | k8s.io/kubernetes | < 1.29.14 | 1.29.14 | GHSA-jgfp-53c3-624w |
| Go | k8s.io/kubernetes | < 1.29.14 · >= 1.30.0, < 1.30.10 · >= 1.31.0, < 1.31.6 · >= 1.32.0, < 1.32.2 | 1.29.14, 1.30.10, 1.31.6, 1.32.2 | GO-2025-3465 |
Advisories 8
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:0037-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:14819-1 kubernetes1.32-apiserver-1.32.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14889-1 govulncheck-vulndb-0.0.20250312T181707-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14818-1 kubernetes1.31-apiserver-1.31.6-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14817-1 kubernetes1.30-apiserver-1.30.10-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14816-1 kubernetes1.29-apiserver-1.29.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0365 Kubernetes: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Mar 10, 2025