Database/Container, Kubernetes & orchestration
Kubernetes (kube-apiserver): "Billion laughs": malicious YAML/JSON payload consumes all apiserver memory
CVSS 7.5CVE-2019-11253Container, Kubernetes & orchestrationcurated
Impact
"Billion laughs": malicious YAML/JSON payload consumes all apiserver memory; control-plane DoS
Who can reach it
Any authorized cluster user, and unauthenticated if anonymous auth is on
What to do
Rolling control-plane upgrade; no GPU drain
References
Related entries
- Kubernetes (kube-apiserver): A node can delete itself, and cascade-delete other objects, by adding an OwnerReferenceCVE-2025-5187 · Kubernetes (kube-apiserver)Medium
- Kubernetes (kube-apiserver): Node address not verified when proxyingCVE-2022-3294 · Kubernetes (kube-apiserver)Medium
- Kubernetes (kube-apiserver): YAML parsing CPU exhaustion in the apiserverCVE-2019-11254 · Kubernetes (kube-apiserver)Medium
- Kubernetes (kube-apiserver): Node updates bypass a validating admission webhook, defeating node-level policyCVE-2021-25735 · Kubernetes (kube-apiserver)Medium
- Kubernetes (kube-apiserver): Users authorized to list/watch one namespaced CR type can read other CR types in the sameCVE-2022-3162 · Kubernetes (kube-apiserver)Medium
- Kubernetes (kube-apiserver): Ephemeral containers bypass the ImagePolicyWebhook, so unapproved images runCVE-2023-2727 · Kubernetes (kube-apiserver)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.