title: Kubernetes API Server denial of service vulnerability from malicious YAML payloads
description: The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
problem types: CWE-1050: Excessive Platform Resource Consumption within a Loop
affected:
{
product: Kubernetes
vendor: Kubernetes
versions:
status: affected, version: prior to 1.15.10
status: affected, version: prior to 1.16.7
status: affected, version: prior to 1.17.3
status: affected, version: 1.1
status: affected, version: 1.2
status: affected, version: 1.3
status: affected, version: 1.4
status: affected, version: 1.5
status: affected, version: 1.6
status: affected, version: 1.7
status: affected, version: 1.8
status: affected, version: 1.9
status: affected, version: 1.10
status: affected, version: 1.11
status: affected, version: 1.12
status: affected, version: 1.13
status: affected, version: 1.14
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]