What’s Vulnerable › Vulnerabilities

CVE-2019-11254: Kubernetes API Server denial of service vulnerability from malicious YAML payloads

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-01 · updated 2026-06-17
• Weakness: CWE-1050

Description

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

Affected products

• Kubernetes: before 1.15.10; from 1.16.0 before 1.16.7; from 1.17.0 before 1.17.3 — fixed in 1.15.10, 1.16.7, 1.17.3
• Go Github.Com/Go-Yaml/Yaml: through 2.1.0
• Gopkg.In/Yaml.V2: before 2.2.8 — fixed in 2.2.8

How to fix

Upgrade to a fixed version: Kubernetes 1.15.10, 1.16.7, 1.17.3; Gopkg.In/Yaml.V2 2.2.8. Check the vendor advisory for mitigations.

References

• https://github.com/kubernetes/kubernetes/issues/89535
• https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
• https://security.netapp.com/advisory/ntap-20200413-0003/
• https://github.com/kubernetes/kubernetes/issues/89535
• https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
• https://security.netapp.com/advisory/ntap-20200413-0003/

Get alerted when CVE-2019-11254 or the next vulnerability affects your stack