CVE

CVE-2019-11253

7.5

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

kubernetes

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

Kubernetes API Server - YAML Parsing DoS (Billion Laughs)

The Kubernetes API server is vulnerable to a denial of service attack via YAML/JSON parsing. An attacker can send a specially crafted YAML/JSON payload that causes exponential memory consumption (Billion Laughs attack), leading to API server crash. References: https://gist.github.com/bgeesaman/0e0349e94cd22c48bf14d8a9b7d6b8f2 https://github.com/kubernetes/kubernetes/issues/83253 https://nvd.nist.gov/vuln/detail/CVE-2019-11253 Remediation: Upgrade to Kubernetes v1.13.12, v1.14.8, v1.15.5, v1.16.2 or later versions with fixed input validation.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: kubernetes

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →