NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
HIGH severity

Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsingGHSA-74fp-r6jw-h4mp

HIGHFix: kubernetes/kubernetes#83261

GHSA-74fp-r6jw-h4mp is a high-severity (CVSS 7.5) vulnerability in k8s.io/apimachinery. A fix is available for k8s.io/apimachinery — see the affected versions and patch details below.

Also known asGO-2022-0965
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Aug 7, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐹k8s.io/apimachinery

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

CVE-2019-11253 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML or JSON payloads to cause kube-apiserver to consume excessive CPU or memory, potentially crashing and becoming unavailable.

When creating a ConfigMap object which has recursive references contained in it, excessive CPU usage can occur. This appears to be an instance of a "Billion Laughs" attack which is quite well known as an XML parsing issue.

Applying this manifest to a cluster causes the client to hang for some time with considerable CPU usage.

apiVersion: v1
data:
  a: &a ["web","web","web","web","web","web","web","web","web"]
  b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a]
  c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b]
  d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c]
  e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d]
  f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e]
  g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f]
  h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g]
  i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]
kind: ConfigMap
metadata:
  name: yaml-bomb
  namespace: default

Specific Go Packages Affected

  • k8s.io/apimachinery/pkg/runtime/serializer/json
  • k8s.io/apimachinery/pkg/util/json

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gok8s.io/apimachineryall versions0.0.0-20190927203648-9ce6eca90e73go get k8s.io/apimachinery@v0.0.0-20190927203648-9ce6eca90e73

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for k8s.io/apimachinery, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update k8s.io/apimachinery to 0.0.0-20190927203648-9ce6eca90e73 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-74fp-r6jw-h4mp is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Frequently Asked Questions

CVE-2019-11253 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML or JSON payloads to cause kube-apiserver to consume excessive CPU or memory, potentially crashing and becoming unavailable. When creating a ConfigMap object which has recursive references contained in it, excessive CPU usage can occur. This appears to be an instance of a "Billion Laughs" attack which is quite well known as an XML parsing issue. Applying this manifest to a cluster causes the client to hang for some time with considerable CPU usage. ```yaml apiVersion:
O3 Security · Impact-Aware SCA

Is GHSA-74fp-r6jw-h4mp in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
Kubernetes apimachinery packages vulnerable to…