What’s Vulnerable › Vulnerabilities

CVE-2024-0793: Kube-controller-manager: malformed hpa v1 manifest causes crash

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-17 · updated 2026-06-17
• Weakness: CWE-20

Description

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

Affected products

• Red Hat OpenShift Container Platform 4.18: all versions
• Red Hat OpenShift Container Platform 4.12: all versions — fixed in 0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el9

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.12 0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el9. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2024:0741
• https://access.redhat.com/errata/RHSA-2024:1267
• https://access.redhat.com/security/cve/CVE-2024-0793
• https://bugzilla.redhat.com/show_bug.cgi?id=2214402
• https://github.com/openshift/kubernetes/pull/1876

Get alerted when CVE-2024-0793 or the next vulnerability affects your stack