Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration
Priority LOW 24CWE-1284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00788 56th percentileScored 2026-11-07
Fix Fixed flux2 (fluxcd): 0.35.0github.com/fluxcd/flux2 (Go): 0.35.0+12 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fluxcd | flux2 | before 0.35.0 | 0.35.0 | Patch available | CNA |
| — | github.com/fluxcd/flux2 (Go) | 0.1.0 to before 0.35.0 | 0.35.0 | Patch available | GHSA-f4p5-x4vc-mh4v |
| — | github.com/fluxcd/source-controller (Go) | 0.0.1-alpha-1 to before 0.30.0 | 0.30.0 | Patch available | GHSA-f4p5-x4vc-mh4v |
| — | github.com/fluxcd/kustomize-controller (Go) | 0.0.1-alpha-1 to before 0.29.0 | 0.29.0 | Patch available | GHSA-f4p5-x4vc-mh4v |
| — | github.com/fluxcd/helm-controller (Go) | 0.0.1-alpha-1 to before 0.24.0 | 0.24.0 | Patch available | GHSA-f4p5-x4vc-mh4v |
| — | github.com/fluxcd/notification-controller (Go) | 0.0.1-alpha-1 to before 0.27.0 | 0.27.0 | Patch available | GHSA-f4p5-x4vc-mh4v |
| — | github.com/fluxcd/image-automation-controller (Go) | 0.1.0 to before 0.26.0 | 0.26.0 | Patch available | GHSA-f4p5-x4vc-mh4v |
| — | github.com/fluxcd/image-reflector-controller (Go) | 0.1.0 to before 0.22.0 | 0.22.0 | Patch available | GHSA-f4p5-x4vc-mh4v |
| — | github.com/fluxcd/helm-controller/api (Go) | before 0.26.0 | 0.26.0 | Patch available | GHSA-f4p5-x4vc-mh4v |
| — | github.com/fluxcd/image-automation-controller/api (Go) | before 0.26.1 | 0.26.1 | Patch available | GHSA-f4p5-x4vc-mh4v |
| — | github.com/fluxcd/image-reflector-controller/api (Go) | before 0.22.1 | 0.22.1 | Patch available | GHSA-f4p5-x4vc-mh4v |
| — | github.com/fluxcd/kustomize-controller/api (Go) | before 0.30.0 | 0.30.0 | Patch available | GHSA-f4p5-x4vc-mh4v |
| — | github.com/fluxcd/notification-controller/api (Go) | before 0.28.0 | 0.28.0 | Patch available | GHSA-f4p5-x4vc-mh4v |
| — | github.com/fluxcd/source-controller/api (Go) | before 0.30.0 | 0.30.0 | Patch available | GHSA-f4p5-x4vc-mh4v |
- flux2 Vendorfluxcd Affected before 0.35.0 Fixed in 0.35.0 Patch available CNA
- github.com/fluxcd/flux2 (Go) Vendor— Affected 0.1.0 to before 0.35.0 Fixed in 0.35.0 Patch available GHSA-f4p5-x4vc-mh4v
- github.com/fluxcd/source-controller (Go) Vendor— Affected 0.0.1-alpha-1 to before 0.30.0 Fixed in 0.30.0 Patch available GHSA-f4p5-x4vc-mh4v
- github.com/fluxcd/kustomize-controller (Go) Vendor— Affected 0.0.1-alpha-1 to before 0.29.0 Fixed in 0.29.0 Patch available GHSA-f4p5-x4vc-mh4v
- github.com/fluxcd/helm-controller (Go) Vendor— Affected 0.0.1-alpha-1 to before 0.24.0 Fixed in 0.24.0 Patch available GHSA-f4p5-x4vc-mh4v
- github.com/fluxcd/notification-controller (Go) Vendor— Affected 0.0.1-alpha-1 to before 0.27.0 Fixed in 0.27.0 Patch available GHSA-f4p5-x4vc-mh4v
- github.com/fluxcd/image-automation-controller (Go) Vendor— Affected 0.1.0 to before 0.26.0 Fixed in 0.26.0 Patch available GHSA-f4p5-x4vc-mh4v
- github.com/fluxcd/image-reflector-controller (Go) Vendor— Affected 0.1.0 to before 0.22.0 Fixed in 0.22.0 Patch available GHSA-f4p5-x4vc-mh4v
- github.com/fluxcd/helm-controller/api (Go) Vendor— Affected before 0.26.0 Fixed in 0.26.0 Patch available GHSA-f4p5-x4vc-mh4v
- github.com/fluxcd/image-automation-controller/api (Go) Vendor— Affected before 0.26.1 Fixed in 0.26.1 Patch available GHSA-f4p5-x4vc-mh4v
- github.com/fluxcd/image-reflector-controller/api (Go) Vendor— Affected before 0.22.1 Fixed in 0.22.1 Patch available GHSA-f4p5-x4vc-mh4v
- github.com/fluxcd/kustomize-controller/api (Go) Vendor— Affected before 0.30.0 Fixed in 0.30.0 Patch available GHSA-f4p5-x4vc-mh4v
- github.com/fluxcd/notification-controller/api (Go) Vendor— Affected before 0.28.0 Fixed in 0.28.0 Patch available GHSA-f4p5-x4vc-mh4v
- github.com/fluxcd/source-controller/api (Go) Vendor— Affected before 0.30.0 Fixed in 0.30.0 Patch available GHSA-f4p5-x4vc-mh4v
CPE configurations NVD · 35
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fluxcd:flux2:*:*:*:*:*:*:*:* | 0.1.0 to before 0.35.0 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:helm-controller:*:*:*:*:*:*:*:* | 0.0.2 to before 0.24.0 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:helm-controller:0.0.1:alpha1:*:*:*:*:*:* | 0.0.1 alpha1 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:helm-controller:0.0.1:alpha2:*:*:*:*:*:* | 0.0.1 alpha2 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:helm-controller:0.0.1:beta1:*:*:*:*:*:* | 0.0.1 beta1 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:helm-controller:0.0.1:beta2:*:*:*:*:*:* | 0.0.1 beta2 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:helm-controller:0.0.1:beta3:*:*:*:*:*:* | 0.0.1 beta3 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:helm-controller:0.0.1:beta4:*:*:*:*:*:* | 0.0.1 beta4 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:image-automation-controller:*:*:*:*:*:*:*:* | 0.1.0 to before 0.26.0 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:image-reflector-controller:*:*:*:*:*:*:*:* | 0.1.0 to before 0.22.0 | Vulnerable | fluxcd |
- cpe:2.3:a:fluxcd:flux2:*:*:*:*:*:*:*:* Versions 0.1.0 to before 0.35.0 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:helm-controller:*:*:*:*:*:*:*:* Versions 0.0.2 to before 0.24.0 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:helm-controller:0.0.1:alpha1:*:*:*:*:*:* Versions 0.0.1 alpha1 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:helm-controller:0.0.1:alpha2:*:*:*:*:*:* Versions 0.0.1 alpha2 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:helm-controller:0.0.1:beta1:*:*:*:*:*:* Versions 0.0.1 beta1 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:helm-controller:0.0.1:beta2:*:*:*:*:*:* Versions 0.0.1 beta2 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:helm-controller:0.0.1:beta3:*:*:*:*:*:* Versions 0.0.1 beta3 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:helm-controller:0.0.1:beta4:*:*:*:*:*:* Versions 0.0.1 beta4 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:image-automation-controller:*:*:*:*:*:*:*:* Versions 0.1.0 to before 0.26.0 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:image-reflector-controller:*:*:*:*:*:*:*:* Versions 0.1.0 to before 0.22.0 Vulnerable ·fluxcd
Show 25 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fluxcd:kustomize-controller:*:*:*:*:*:*:*:* | 0.0.2 to before 0.29.0 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha1:*:*:*:*:*:* | 0.0.1 alpha1 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha2:*:*:*:*:*:* | 0.0.1 alpha2 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha3:*:*:*:*:*:* | 0.0.1 alpha3 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha4:*:*:*:*:*:* | 0.0.1 alpha4 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha5:*:*:*:*:*:* | 0.0.1 alpha5 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha6:*:*:*:*:*:* | 0.0.1 alpha6 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha7:*:*:*:*:*:* | 0.0.1 alpha7 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha8:*:*:*:*:*:* | 0.0.1 alpha8 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha9:*:*:*:*:*:* | 0.0.1 alpha9 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:beta1:*:*:*:*:*:* | 0.0.1 beta1 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:beta2:*:*:*:*:*:* | 0.0.1 beta2 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:notification-controller:*:*:*:*:*:*:*:* | 0.0.2 to before 0.27.0 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:notification-controller:0.0.1:alpha1:*:*:*:*:*:* | 0.0.1 alpha1 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:notification-controller:0.0.1:alpha2:*:*:*:*:*:* | 0.0.1 alpha2 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:notification-controller:0.0.1:beta1:*:*:*:*:*:* | 0.0.1 beta1 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:source-controller:*:*:*:*:*:*:*:* | 0.0.2 to before 0.30.0 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:source-controller:0.0.1:alpha1:*:*:*:*:*:* | 0.0.1 alpha1 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:source-controller:0.0.1:alpha2:*:*:*:*:*:* | 0.0.1 alpha2 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:source-controller:0.0.1:alpha3:*:*:*:*:*:* | 0.0.1 alpha3 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:source-controller:0.0.1:alpha4:*:*:*:*:*:* | 0.0.1 alpha4 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:source-controller:0.0.1:alpha5:*:*:*:*:*:* | 0.0.1 alpha5 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:source-controller:0.0.1:alpha6:*:*:*:*:*:* | 0.0.1 alpha6 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:source-controller:0.0.1:beta1:*:*:*:*:*:* | 0.0.1 beta1 | Vulnerable | fluxcd |
| cpe:2.3:a:fluxcd:source-controller:0.0.1:beta2:*:*:*:*:*:* | 0.0.1 beta2 | Vulnerable | fluxcd |
- cpe:2.3:a:fluxcd:kustomize-controller:*:*:*:*:*:*:*:* Versions 0.0.2 to before 0.29.0 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha1:*:*:*:*:*:* Versions 0.0.1 alpha1 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha2:*:*:*:*:*:* Versions 0.0.1 alpha2 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha3:*:*:*:*:*:* Versions 0.0.1 alpha3 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha4:*:*:*:*:*:* Versions 0.0.1 alpha4 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha5:*:*:*:*:*:* Versions 0.0.1 alpha5 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha6:*:*:*:*:*:* Versions 0.0.1 alpha6 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha7:*:*:*:*:*:* Versions 0.0.1 alpha7 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha8:*:*:*:*:*:* Versions 0.0.1 alpha8 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:alpha9:*:*:*:*:*:* Versions 0.0.1 alpha9 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:beta1:*:*:*:*:*:* Versions 0.0.1 beta1 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:kustomize-controller:0.0.1:beta2:*:*:*:*:*:* Versions 0.0.1 beta2 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:notification-controller:*:*:*:*:*:*:*:* Versions 0.0.2 to before 0.27.0 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:notification-controller:0.0.1:alpha1:*:*:*:*:*:* Versions 0.0.1 alpha1 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:notification-controller:0.0.1:alpha2:*:*:*:*:*:* Versions 0.0.1 alpha2 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:notification-controller:0.0.1:beta1:*:*:*:*:*:* Versions 0.0.1 beta1 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:source-controller:*:*:*:*:*:*:*:* Versions 0.0.2 to before 0.30.0 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:source-controller:0.0.1:alpha1:*:*:*:*:*:* Versions 0.0.1 alpha1 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:source-controller:0.0.1:alpha2:*:*:*:*:*:* Versions 0.0.1 alpha2 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:source-controller:0.0.1:alpha3:*:*:*:*:*:* Versions 0.0.1 alpha3 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:source-controller:0.0.1:alpha4:*:*:*:*:*:* Versions 0.0.1 alpha4 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:source-controller:0.0.1:alpha5:*:*:*:*:*:* Versions 0.0.1 alpha5 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:source-controller:0.0.1:alpha6:*:*:*:*:*:* Versions 0.0.1 alpha6 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:source-controller:0.0.1:beta1:*:*:*:*:*:* Versions 0.0.1 beta1 Vulnerable ·fluxcd
- cpe:2.3:a:fluxcd:source-controller:0.0.1:beta2:*:*:*:*:*:* Versions 0.0.1 beta2 Vulnerable ·fluxcd
Remediation
- Fix · CNA flux2 (fluxcd) Fixed in 0.35.0
- Fix · GHSA-f4p5-x4vc-mh4v github.com/fluxcd/flux2 (Go) Fixed in 0.35.0 Advisory →
- Fix · GHSA-f4p5-x4vc-mh4v github.com/fluxcd/source-controller (Go) Fixed in 0.30.0 Advisory →
- Fix · GHSA-f4p5-x4vc-mh4v github.com/fluxcd/kustomize-controller (Go) Fixed in 0.29.0 Advisory →
- Fix · GHSA-f4p5-x4vc-mh4v github.com/fluxcd/helm-controller (Go) Fixed in 0.24.0 Advisory →
- Fix · GHSA-f4p5-x4vc-mh4v github.com/fluxcd/notification-controller (Go) Fixed in 0.27.0 Advisory →
- Fix · GHSA-f4p5-x4vc-mh4v github.com/fluxcd/image-automation-controller (Go) Fixed in 0.26.0 Advisory →
- Fix · GHSA-f4p5-x4vc-mh4v github.com/fluxcd/image-reflector-controller (Go) Fixed in 0.22.0 Advisory →
- Fix · GHSA-f4p5-x4vc-mh4v github.com/fluxcd/helm-controller/api (Go) Fixed in 0.26.0 Advisory →
- Fix · GHSA-f4p5-x4vc-mh4v github.com/fluxcd/image-automation-controller/api (Go) Fixed in 0.26.1 Advisory →
- Fix · GHSA-f4p5-x4vc-mh4v github.com/fluxcd/image-reflector-controller/api (Go) Fixed in 0.22.1 Advisory →
- Fix · GHSA-f4p5-x4vc-mh4v github.com/fluxcd/kustomize-controller/api (Go) Fixed in 0.30.0 Advisory →
- Fix · GHSA-f4p5-x4vc-mh4v github.com/fluxcd/notification-controller/api (Go) Fixed in 0.28.0 Advisory →
- Fix · GHSA-f4p5-x4vc-mh4v github.com/fluxcd/source-controller/api (Go) Fixed in 0.30.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-39272
- 2026-10-03 Alias added: GHSA-f4p5-x4vc-mh4v
References
Advisory 2
Other 9
- https://github.com/fluxcd/helm-controller/pull/533
- https://github.com/fluxcd/image-automation-controller/pull/439
- https://github.com/fluxcd/image-reflector-controller/pull/314
- https://github.com/fluxcd/kustomize-controller/pull/731
- https://github.com/fluxcd/notification-controller/pull/420
- https://github.com/fluxcd/source-controller/pull/903
- https://github.com/fluxcd/flux2
- https://github.com/kubernetes/apimachinery#131
- https://pkg.go.dev/vuln/GO-2022-1071
More fluxcd Flux2 vulnerabilities
- TI-2022-08687 Improper path handling in kustomization files allows path traversal CVSS 3.1CRITICAL 9.9
- TI-2022-08630 Improper kubeconfig validation allows arbitrary code execution CVSS 3.1CRITICAL 9.9
- TI-2022-16473 Flux2 Helm Controller denial of service CVSS 3.1HIGH 7.7
- TI-2022-16460 Flux CLI Workload Injection CVSS 3.1HIGH 7.8
- TI-2022-08688 Improper path handling in Kustomization files allows for denial of service CVSS 3.1HIGH 7.7
Sources
- CVE-2022-39272 · CVE Program
- CVE-2022-39272 · NVD
- FIRST EPSS
- GHSA-f4p5-x4vc-mh4v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences