<p>Create <code>yaml-bomb.yaml</code> file:</p>

<pre><code>apiVersion: v1
data:
  a: &amp;a ["web","web","web","web","web","web","web","web","web"]
  b: &amp;b [*a,*a,*a,*a,*a,*a,*a,*a,*a]
  c: &amp;c [*b,*b,*b,*b,*b,*b,*b,*b,*b]
  d: &amp;d [*c,*c,*c,*c,*c,*c,*c,*c,*c]
  e: &amp;e [*d,*d,*d,*d,*d,*d,*d,*d,*d]
  f: &amp;f [*e,*e,*e,*e,*e,*e,*e,*e,*e]
  g: &amp;g [*f,*f,*f,*f,*f,*f,*f,*f,*f]
  h: &amp;h [*g,*g,*g,*g,*g,*g,*g,*g,*g]
  i: &amp;i [*h,*h,*h,*h,*h,*h,*h,*h,*h]
kind: ConfigMap
metadata:
  name: yaml-bomb
  namespace: default
</code></pre>

<p>Send <code>ConfigMap</code> creation request to Kubernetes API by cmd <code>kubectl apply -f yaml-bomb.yaml</code>.</p>

<p><code>kube-api</code> CPU/memory usage are very high, even later are getting restarted.</p>

<p>How do we prevent such yaml-bomb?</p>

<p>This is a <a href="https://en.wikipedia.org/wiki/Billion_laughs_attack" rel="noreferrer">billion laughts attack</a> and can only be fixed in the YAML processor.</p>

<p>Note that the Wikipedia is wrong here when it says</p>

<blockquote>
  <p>A "Billion laughs" attack should exist for any file format that can contain references, for example this YAML bomb: </p>
</blockquote>

<p>The problem is not that the file format contains references; it is the processor expanding them. This is against the spirit of the YAML spec which says that anchors are used for nodes that are actually referred to from multiple places. In the loaded data, anchors &amp; aliases should become multiple references to the same object instead of the alias being expanded to a copy of the anchored node.</p>

<p>As an example, compare the behavior of the <a href="https://yaml-online-parser.appspot.com/" rel="noreferrer">online PyYAML parser</a> and the <a href="https://nimyaml.org/testing.html" rel="noreferrer">online NimYAML parser</a> (full disclosure: my work) when you paste your code snippet. PyYAML won't respond because of the memory load from expanding aliases, while NimYAML doesn't expand the aliases and therefore responds quickly.</p>

<p>It's astonishing that Kubernetes suffers from this problem; I would have assumed since it's written in Go that they are able to properly handle references. You have to file a bug with them to get this fixed.</p>
