CVE-2026-24514 | THREATINT

Description

A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx controller pod being killed or the node running out of memory.

PUBLISHED Reserved 2026-01-23 | Published 2026-02-03 | Updated 2026-02-18 | Assigner kubernetes

MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem types

CWE-770 Allocation of Resources Without Limits or Throttling

Product status

Default status

affected

Any version before 1.13.7

affected

Any version before 1.14.3

affected

Credits

Matan Shabtay finder

References

github.com/kubernetes/kubernetes/issues/136680

cve.org (CVE-2026-24514)

nvd.nist.gov (CVE-2026-24514)

Download JSON