CVE-2019-11253

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.

• CWE-20
• CWE-776

• https://access.redhat.com/errata/RHSA-2019:3239Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3811Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3905Third Party Advisory
• https://github.com/kubernetes/kubernetes/issues/83253Exploit, Issue Tracking, Mitigation, Third Party Advisory
• https://groups.google.com/forum/#%21topic/kubernetes-security-announce/jk8polzSUxsPermissions Required
• https://security.netapp.com/advisory/ntap-20191031-0006/Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3239Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3811Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3905Third Party Advisory
• https://github.com/kubernetes/kubernetes/issues/83253Exploit, Issue Tracking, Mitigation, Third Party Advisory
• https://groups.google.com/forum/#%21topic/kubernetes-security-announce/jk8polzSUxsPermissions Required
• https://security.netapp.com/advisory/ntap-20191031-0006/Third Party Advisory

Published

Oct 17, 2019

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11248The debugging endpoint /debug/pprof is exposed over the unau…8.2
• CVE-2019-11249The kubectl cp command allows copying files between containe…6.5
• CVE-2019-1125An information disclosure vulnerability exists when certain …5.6
• CVE-2019-11250The Kubernetes client-go library logs request headers at ver…6.5
• CVE-2019-11251The Kubernetes kubectl cp command in versions 1.1-1.12, and …5.7
• CVE-2019-11252The Kubernetes kube-controller-manager in versions v1.0-v1.1…6.5
• CVE-2019-11254The Kubernetes API Server component in versions 1.1-1.14, an…6.5
• CVE-2019-11255Improper input validation in Kubernetes CSI sidecar containe…6.5
• CVE-2019-11256Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2019-11257Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2019-11258Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2019-11259Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…