PT-2019-5264 · Kubernetes+1 · Kubernetes+1

Published 2019-02-28 · Updated 2025-08-08 · CVE-2019-1002100

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Kubernetes versions prior to 1.11.8 Kubernetes versions prior to 1.12.6 Kubernetes versions prior to 1.13.4

Description The issue is related to an uncontrolled resource consumption in the Kubernetes API Server. It can be exploited by sending a specially crafted patch of type "json-patch" (e.g., kubectl patch --type json or "Content-Type: application/json-patch+json") that consumes excessive resources while processing, causing a Denial of Service on the API Server. This can be done by users authorized to make patch requests to the Kubernetes API Server.

Recommendations For versions prior to 1.11.8, update to version 1.11.8 or later. For versions prior to 1.12.6, update to version 1.12.6 or later. For versions prior to 1.13.4, update to version 1.13.4 or later.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

ALT-PU-2019-1504

BDU:2020-02155

CVE-2019-1002100

GHSA-Q4RR-64R9-FWGF

GO-2023-1946

OPENSUSE-SU-2025:15424-1

RHSA-2019:1851

RHSA-2019:3239

Affected Products

Alt Linux

Kubernetes

References · 72

• https://github.com/kubernetes/kubernetes/issues/74534 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-1002100 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-1002100 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1002100 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-1002100 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2019-4609.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1002100 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:1851 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q4rr-64r9-fwgf · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15424-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1002100 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3239 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-1002100 · Security Note
• https://osv.dev/vulnerability/GO-2023-1946 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02155 · Security Note