CVE-2022-39272 Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

Medium 5.0 Published 21 Oct 2022 Updated 23 Apr 2025

Attackers with object modification permissions can cause denial of service in Flux by providing invalid duration values, requiring an upgrade to fix.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-39272?

CVE-2022-39272 is a medium-severity denial of service vulnerability in fluxcd flux2, published on 21 Oct 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.

Weakness: CWE-1284

Which versions are affected by CVE-2022-39272?

34 open source packages ship an affected version, including github.com/fluxcd/flux2, flux and kustomize. It affects 7 products.

Package	Affected	Fixed in
`github.com/fluxcd/flux2` Go	From `0.1.0`	`0.35.0`
`github.com/fluxcd/flux2` Go	From `0.1.0`	`0.35.0`
`flux` Bitnami	From `0.1.0`	`0.35.0`
`kustomize` Bitnami	From `0.0.2`	`0.29.0`
`github.com/fluxcd/helm-controller` Go	From `0.0.1-alpha-1`	`0.24.0`
`github.com/fluxcd/helm-controller` Go	From `0.0.1-alpha-1`	`0.24.0`

28 more packages

`github.com/fluxcd/helm-controller/api` Go	All versions	`0.26.0`
`github.com/fluxcd/helm-controller/api` Go	All versions	`0.26.0`
`github.com/fluxcd/helm-controller/api` Go	All versions	`0.26.0`
`github.com/fluxcd/image-automation-controller` Go	From `0.1.0`	`0.26.0`
`github.com/fluxcd/image-automation-controller` Go	From `0.1.0`	`0.26.0`
`github.com/fluxcd/image-automation-controller/api` Go	All versions	`0.26.1`
`github.com/fluxcd/image-automation-controller/api` Go	All versions	`0.26.1`
`github.com/fluxcd/image-automation-controller/api` Go	All versions	`0.26.1`
`github.com/fluxcd/image-reflector-controller` Go	From `0.1.0`	`0.22.0`
`github.com/fluxcd/image-reflector-controller` Go	From `0.1.0`	`0.22.0`
`github.com/fluxcd/image-reflector-controller/api` Go	All versions	`0.22.1`
`github.com/fluxcd/image-reflector-controller/api` Go	All versions	`0.22.1`
`github.com/fluxcd/image-reflector-controller/api` Go	All versions	`0.22.1`
`github.com/fluxcd/kustomize-controller` Go	From `0.0.1-alpha-1`	`0.29.0`
`github.com/fluxcd/kustomize-controller` Go	From `0.0.1-alpha-1`	`0.29.0`
`github.com/fluxcd/kustomize-controller/api` Go	All versions	`0.30.0`
`github.com/fluxcd/kustomize-controller/api` Go	All versions	`0.30.0`
`github.com/fluxcd/kustomize-controller/api` Go	All versions	`0.30.0`
`github.com/fluxcd/notification-controller` Go	From `0.0.1-alpha-1`	`0.27.0`
`github.com/fluxcd/notification-controller` Go	From `0.0.1-alpha-1`	`0.27.0`
`github.com/fluxcd/notification-controller/api` Go	All versions	`0.28.0`
`github.com/fluxcd/notification-controller/api` Go	All versions	`0.28.0`
`github.com/fluxcd/notification-controller/api` Go	All versions	`0.28.0`
`github.com/fluxcd/source-controller` Go	From `0.0.1-alpha-1`	`0.30.0`
`github.com/fluxcd/source-controller` Go	From `0.0.1-alpha-1`	`0.30.0`
`github.com/fluxcd/source-controller/api` Go	All versions	`0.30.0`
`github.com/fluxcd/source-controller/api` Go	All versions	`0.30.0`
`github.com/fluxcd/source-controller/api` Go	All versions	`0.30.0`

Products include Fluxcd Flux2, Fluxcd Helm-Controller, Fluxcd Image-Automation-Controller, Fluxcd Image-Reflector-Controller, Fluxcd Kustomize-Controller, Fluxcd Notification-Controller and 1 more.

How do I fix CVE-2022-39272?

Upgrade github.com/fluxcd/flux2 to 0.35.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-39272 being exploited?

There is no known exploitation of CVE-2022-39272 in the wild and no public exploit code.

Sources

Also known as BIT-flux-2022-39272, BIT-kustomize-2022-39272, GHSA-f4p5-x4vc-mh4v, GO-2022-1071.