{"schema_version":"1.8.0","id":"CVE-2019-11253","published":"2019-10-17T16:15:10.443Z","modified":"2026-08-07T11:48:03.133450433Z","aliases":["GHSA-pmqp-h87c-mr78","GO-2022-0703"],"related":["CGA-rw74-h3gm-g3gf","openSUSE-SU-2024:10901-1","openSUSE-SU-2025:15424-1"],"details":"Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes/kubelet","events":[{"introduced":"0"},{"last_affected":"c20f6e0006cca199d641ad1307ebd9f72c141bc0"},{"introduced":"36ea738c771d6b8a50df632f092f5805818476c3"},{"fixed":"e7fc4f69fc2cdc4714a7531fdf40e87492e892d4"},{"introduced":"f6da02f583256d1a15cc44a101c80bfa2080a46f"},{"fixed":"b3d1a6b2a385ac50138039b92fcd82a457406421"},{"introduced":"f1cb295a73c9298232b9848aa1b4029e36fc91e5"},{"fixed":"100045381629928ace0d8764270005af74dd6eb5"},{"introduced":"250a1838aa2c492c9096ff86558515b8639d7e87"},{"fixed":"7841ed97f1b27683bb19367f01d3155524d5f5f0"}],"database_specific":{"cpe":"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.1.0"},{"last_affected":"1.12.10"},{"introduced":"1.13.0"},{"fixed":"1.13.12"},{"introduced":"1.14.0"},{"fixed":"1.14.8"},{"introduced":"1.15.0"},{"fixed":"1.15.5"},{"introduced":"1.16.0"},{"fixed":"1.16.2"}],"source":"CPE_RANGE"}}],"versions":["kubernetes-1.13.12-beta.0","kubernetes-1.13.11-beta.0","kubernetes-1.13.11","kubernetes-1.13.10","kubernetes-1.14.1-beta.0","kubernetes-1.14.0-rc.1","kubernetes-1.14.0","kubernetes-1.12.10","kubernetes-1.12.6-beta.0","kubernetes-1.12.5-beta.0","kubernetes-1.12.5","kubernetes-1.12.4","kubernetes-1.9.0-alpha.3","kubernetes-1.9.0-alpha.2","kubernetes-1.9.0-alpha.1","kubernetes-1.9.0-alpha.0","kubernetes-1.13.0-alpha.0","kubernetes-1.12.0-beta.0","kubernetes-1.12.0-alpha.1","kubernetes-1.12.0-alpha.0","kubernetes-1.11.0-alpha.2","kubernetes-1.11.0-alpha.1","kubernetes-1.11.0-alpha.0","kubernetes-1.10.0-alpha.3","kubernetes-1.10.0-alpha.2","kubernetes-1.10.0-alpha.1","kubernetes-1.10.0-alpha.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11253.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes/kubernetes","events":[{"introduced":"7d6c8b640f2e90cf2347fb46ef4cf46cd3280015"},{"last_affected":"e3c134023df5dea457638b614ee17ef234dc34a6"},{"introduced":"ddf47ac13c1a9483ea035a79cd7c10005ff21a6d"},{"fixed":"a8b52209ee172232b6db7a6e0ce2adc77458829f"},{"introduced":"641856db18352033a0d96dbc99153fa3b27298e5"},{"fixed":"211047e9a1922595eaa3a1127ed365e9299a6c23"},{"introduced":"e8462b5b5dc2584fdcd18e6bcfe9f1e4d970a529"},{"fixed":"20c265fef0741dd71a66480e35bd69f18351daea"},{"introduced":"2bd9643cee5b3b3a5ecbd3af49d09018f0773c77"},{"fixed":"c97fe5036ef3df2967d086711e6c0c405941e14b"}],"database_specific":{"cpe":"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.1.0"},{"last_affected":"1.12.10"},{"introduced":"1.13.0"},{"fixed":"1.13.12"},{"introduced":"1.14.0"},{"fixed":"1.14.8"},{"introduced":"1.15.0"},{"fixed":"1.15.5"},{"introduced":"1.16.0"},{"fixed":"1.16.2"}],"source":"CPE_RANGE"}}],"versions":["v1.16.2-beta.0","v1.16.1","v1.15.5-beta.0","v1.14.8-beta.0","v1.16.1-beta.0","v1.13.12-beta.0","v1.15.4","v1.14.7","v1.13.11","v1.16.0","v1.14.7-beta.0","v1.15.4-beta.0","v1.13.11-beta.0","v1.15.3","v1.14.6","v1.13.10","v1.15.3-beta.0","v1.14.6-beta.0","v1.13.10-beta.0","v1.15.2","v1.13.9","v1.14.5","v1.15.2-beta.0","v1.15.1","v1.14.5-beta.0","v1.13.9-beta.0","v1.14.4","v1.13.8","v1.15.0","v1.15.1-beta.0","v1.14.4-beta.0","v1.13.8-beta.0","v1.13.7","v1.14.3","v1.14.3-beta.0","v1.14.2","v1.13.7-beta.0","v1.13.6","v1.14.2-beta.0","v1.14.1","v1.14.1-beta.0","v1.13.6-beta.0","v1.14.0","v1.13.5","v1.13.5-beta.0","v1.13.4","v1.13.4-beta.0","v1.13.3","v1.13.3-beta.0","v1.13.2","v1.13.2-beta.0","v1.13.1","v1.13.1-beta.0","v1.13.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11253.json"}}],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3239"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3811"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3905"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20191031-0006/"},{"type":"REPORT","url":"https://github.com/kubernetes/kubernetes/issues/83253"},{"type":"REPORT","url":"https://groups.google.com/forum/#%21topic/kubernetes-security-announce/jk8polzSUxs"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*","cpe:2.3:a:redhat:openshift_container_platform:3.9:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.9"},{"last_affected":"3.9"},{"introduced":"3.10"},{"last_affected":"3.10"},{"introduced":"3.11"},{"last_affected":"3.11"}],"source":"CPE_STRING","vendor_product":"redhat:openshift_container_platform"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}