CVE-2019-11253

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20 CWE-776

Affected software

Vendor	Product	Versions
Kubernetes	Kubernetes	prior to 1.13.12; prior to 1.14.8; prior to 1.15.5; prior to 1.16.2; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12

References

https://access.redhat.com/errata/RHSA-2019:3239Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3811Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3905Third Party Advisory
https://github.com/kubernetes/kubernetes/issues/83253Exploit, Issue Tracking, Mitigation, Third Party Advisory
https://groups.google.com/forum/#%21topic/kubernetes-security-announce/jk8polzSUxsPermissions Required
https://security.netapp.com/advisory/ntap-20191031-0006/Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3239Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3811Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3905Third Party Advisory
https://github.com/kubernetes/kubernetes/issues/83253Exploit, Issue Tracking, Mitigation, Third Party Advisory
https://groups.google.com/forum/#%21topic/kubernetes-security-announce/jk8polzSUxsPermissions Required
https://security.netapp.com/advisory/ntap-20191031-0006/Third Party Advisory

Timeline

Published: Oct 17, 2019
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-112546.5The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sen CVE-2019-112556.5Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external CVE-2019-11265.3A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which could allow an attacker to bypass the ex CVE-2019-112684.3Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic rea CVE-2019-112695.4Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsuppo CVE-2019-11278.8A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V CVE-2019-112707.5Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or sco CVE-2019-112717.8Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to us CVE-2019-112727.3Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If CVE-2019-112734.3Pivotal Container Services (PKS) versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable component which log CVE-2019-112746.1Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL t CVE-2019-112754.3Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, ver