What’s Vulnerable › Vulnerabilities

CVE-2022-39272: Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-22 · updated 2026-06-17
• Weakness: CWE-1284

Description

Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.

Affected products

• fluxcd flux2: from 0.1.0 before 0.35.0 — fixed in 0.35.0
• fluxcd Helm-Controller: from 0.0.2 before 0.24.0; 0.0.1-alpha1, 0.0.1-alpha2, 0.0.1-beta1, 0.0.1-beta2, 0.0.1-beta3, 0.0.1-beta4 — fixed in 0.24.0
• fluxcd Image-Automation-Controller: from 0.1.0 before 0.26.0 — fixed in 0.26.0
• fluxcd Image-Reflector-Controller: from 0.1.0 before 0.22.0 — fixed in 0.22.0
• fluxcd kustomize-controller: from 0.0.2 before 0.29.0; 0.0.1-alpha1, 0.0.1-alpha2, 0.0.1-alpha3, 0.0.1-alpha4, 0.0.1-alpha5, 0.0.1-alpha6 (+5) — fixed in 0.29.0
• fluxcd notification-controller: from 0.0.2 before 0.27.0; 0.0.1-alpha1, 0.0.1-alpha2, 0.0.1-beta1 — fixed in 0.27.0
• fluxcd source-controller: from 0.0.2 before 0.30.0; 0.0.1-alpha1, 0.0.1-alpha2, 0.0.1-alpha3, 0.0.1-alpha4, 0.0.1-alpha5, 0.0.1-alpha6 (+2) — fixed in 0.30.0

How to fix

Upgrade to a fixed version: fluxcd flux2 0.35.0; fluxcd Helm-Controller 0.24.0; fluxcd Image-Automation-Controller 0.26.0; fluxcd Image-Reflector-Controller 0.22.0; fluxcd kustomize-controller 0.29.0; fluxcd notification-controller 0.27.0; fluxcd source-controller 0.30.0. Check the vendor advisory for mitigations.

References

• https://github.com/fluxcd/flux2/security/advisories/GHSA-f4p5-x4vc-mh4v
• https://github.com/kubernetes/apimachinery/issues/131
• https://github.com/fluxcd/flux2/security/advisories/GHSA-f4p5-x4vc-mh4v
• https://github.com/kubernetes/apimachinery/issues/131

Get alerted when CVE-2022-39272 or the next vulnerability affects your stack