CVE-2019-11253 Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack
Authorized users can send malicious YAML or JSON payloads to the Kubernetes API server, causing resource exhaustion and service unavailability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11253?
CVE-2019-11253 is a high-severity denial of service vulnerability in Kubernetes Kubernetes, published on 17 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.
Which versions are affected by CVE-2019-11253?
9 open source packages ship an affected version, including k8s.io/kubernetes. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/kubernetes Go | From 1.0.0 | 1.13.12, 1.14.8, 1.15.5, 1.16.2 |
k8s.io/kubernetes Go | From 1.0.0 | 1.13.12 |
k8s.io/kubernetes Go | From 1.0.0 | 1.13.12 |
k8s.io/kubernetes Go | From 1.14.0 | 1.14.8 |
k8s.io/kubernetes Go | From 1.14.0 | 1.14.8 |
k8s.io/kubernetes Go | From 1.15.0 | 1.15.5 |
3 more packages
k8s.io/kubernetes Go | From 1.15.0 | 1.15.5 |
k8s.io/kubernetes Go | From 1.16.0 | 1.16.2 |
k8s.io/kubernetes Go | From 1.16.0 | 1.16.2 |
Linux distribution packages (29)
openshift Red Hat:openshift:4.1::el7 | All versions | 0:4.1.20-201910101746.git.0.a80aad5.el7 |
openshift-clients Red Hat:openshift:4.1::el7 | All versions | 0:4.1.20-201910101746.git.0.a80aad5.el7 |
openshift-clients-redistributable Red Hat:openshift:4.1::el7 | All versions | 0:4.1.20-201910101746.git.0.a80aad5.el7 |
openshift-hyperkube Red Hat:openshift:4.1::el7 | All versions | 0:4.1.20-201910101746.git.0.a80aad5.el7 |
openshift Red Hat:openshift:4.1::el8 | All versions | 0:4.1.20-201910101746.git.0.a80aad5.el8 |
openshift-clients Red Hat:openshift:4.1::el8 | All versions | 0:4.1.20-201910101746.git.0.a80aad5.el8 |
openshift-clients-redistributable Red Hat:openshift:4.1::el8 | All versions | 0:4.1.20-201910101746.git.0.a80aad5.el8 |
openshift-hyperkube Red Hat:openshift:4.1::el8 | All versions | 0:4.1.20-201910101746.git.0.a80aad5.el8 |
jaeger Red Hat:service_mesh:1.0::el7 | All versions | 0:v1.13.1.redhat5-1.el7 |
jaeger-operator Red Hat:service_mesh:1.0::el7 | All versions | 0:v1.13.1.redhat8-1.el7 |
kiali Red Hat:service_mesh:1.0::el7 | All versions | 0:v1.0.7.redhat1-1.el7 |
servicemesh Red Hat:service_mesh:1.0::el8 | All versions | 0:1.0.2-3.el8 |
servicemesh-citadel Red Hat:service_mesh:1.0::el8 | All versions | 0:1.0.2-3.el8 |
servicemesh-cni Red Hat:service_mesh:1.0::el8 | All versions | 0:1.0.11-1.el8 |
servicemesh-cni Red Hat:service_mesh:1.0::el8 | All versions | 0:1.0.2-3.el8 |
servicemesh-galley Red Hat:service_mesh:1.0::el8 | All versions | 0:1.0.2-3.el8 |
servicemesh-grafana Red Hat:service_mesh:1.0::el8 | All versions | 0:6.2.2-24.el8 |
servicemesh-grafana-prometheus Red Hat:service_mesh:1.0::el8 | All versions | 0:6.2.2-24.el8 |
servicemesh-istioctl Red Hat:service_mesh:1.0::el8 | All versions | 0:1.0.2-3.el8 |
servicemesh-mixc Red Hat:service_mesh:1.0::el8 | All versions | 0:1.0.2-3.el8 |
servicemesh-mixs Red Hat:service_mesh:1.0::el8 | All versions | 0:1.0.2-3.el8 |
servicemesh-operator Red Hat:service_mesh:1.0::el8 | All versions | 0:1.0.2-7.el8 |
servicemesh-pilot-agent Red Hat:service_mesh:1.0::el8 | All versions | 0:1.0.2-3.el8 |
servicemesh-pilot-discovery Red Hat:service_mesh:1.0::el8 | All versions | 0:1.0.2-3.el8 |
servicemesh-prometheus Red Hat:service_mesh:1.0::el8 | All versions | 0:2.7.2-25.el8 |
servicemesh-prometheus Red Hat:service_mesh:1.0::el8 | All versions | 0:2.7.2-36.el8 |
servicemesh-proxy Red Hat:service_mesh:1.0::el8 | All versions | 0:1.0.2-3.el8 |
servicemesh-sidecar-injector Red Hat:service_mesh:1.0::el8 | All versions | 0:1.0.2-3.el8 |
servicemesh-cni Red Hat:service_mesh:1.1::el8 | All versions | 0:1.1.4-2.el8 |
Products include Kubernetes Kubernetes, Redhat Openshift Container Platform.
How do I fix CVE-2019-11253?
Upgrade k8s.io/kubernetes to a fixed version for your release line: 1.13.12, 1.14.8, 1.15.5 or 1.16.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-11253 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-11253 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Kubernetes Kubernetes
- CVE-2018-1002105 Privilege Escalation in Kubernetes
- CVE-2017-1000056 Kubernetes Privilege Escalation
- CVE-2016-1906 Authorization bypass in Openshift
- CVE-2023-3676 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
- CVE-2023-3955 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
Sources
Also known as CLEANSTART-2025-ZG19712, DEBIAN-CVE-2019-11253, GHSA-pmqp-h87c-mr78, GO-2022-0703, RHEA-2019:3809, RHSA-2019:3132 and 3 more.