Uncontrolled resource consumption in Kubernetes kubelet
Priority LOW 28CWE-400Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00372 31st percentileScored 2026-11-07
Fix Partial kubelet (Kubernetes): 1.32.2, 1.31.6, 1.30.10k8s.io/kubernetes (Go): 1.32.2, 1.31.6, 1.30.10 +1Red Hat: 2 advisoriesRed Hat: 2 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | kubelet | 1.32.0 – 1.32.1; 1.31.0 – 1.31.5; 1.30.0 – 1.30.9 | 1.32.2, 1.31.6, 1.30.10 | Patch available | CNA |
| — | k8s.io/kubernetes (Go) | 1.32.0 to before 1.32.2 | 1.32.2 | Patch available | GHSA-jgfp-53c3-624w |
| — | k8s.io/kubernetes (Go) | 1.31.0 to before 1.31.6 | 1.31.6 | Patch available | GHSA-jgfp-53c3-624w |
| — | k8s.io/kubernetes (Go) | 1.30.0 to before 1.30.10 | 1.30.10 | Patch available | GHSA-jgfp-53c3-624w |
| — | k8s.io/kubernetes (Go) | before 1.29.14 | 1.29.14 | Patch available | GHSA-jgfp-53c3-624w |
- kubelet VendorKubernetes Affected 1.32.0 – 1.32.1; 1.31.0 – 1.31.5; 1.30.0 – 1.30.9 Fixed in 1.32.2, 1.31.6, 1.30.10 Patch available CNA
- k8s.io/kubernetes (Go) Vendor— Affected 1.32.0 to before 1.32.2 Fixed in 1.32.2 Patch available GHSA-jgfp-53c3-624w
- k8s.io/kubernetes (Go) Vendor— Affected 1.31.0 to before 1.31.6 Fixed in 1.31.6 Patch available GHSA-jgfp-53c3-624w
- k8s.io/kubernetes (Go) Vendor— Affected 1.30.0 to before 1.30.10 Fixed in 1.30.10 Patch available GHSA-jgfp-53c3-624w
- k8s.io/kubernetes (Go) Vendor— Affected before 1.29.14 Fixed in 1.29.14 Patch available GHSA-jgfp-53c3-624w
Remediation
- Fix · CNA kubelet (Kubernetes) Fixed in 1.32.2, 1.31.6, 1.30.10
- Fix · GHSA-jgfp-53c3-624w k8s.io/kubernetes (Go) Fixed in 1.32.2 Advisory →
- Fix · GHSA-jgfp-53c3-624w k8s.io/kubernetes (Go) Fixed in 1.31.6 Advisory →
- Fix · GHSA-jgfp-53c3-624w k8s.io/kubernetes (Go) Fixed in 1.30.10 Advisory →
- Fix · GHSA-jgfp-53c3-624w k8s.io/kubernetes (Go) Fixed in 1.29.14 Advisory →
Red Hat 2 advisories
- RHSA-2025:2652 Released 2025-03-11 · Red Hat rating ImportantRHODF-4.18-RHEL-9 enhancement, bug fix and security update
- RHODF 4.18 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/ocs-metrics-exporter-rhel9 +3
- RHSA-2025:1824 Released 2025-02-25 · Red Hat rating ImportantRHODF-4.17-RHEL-9 security update
- RHODF 4.17 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-cli-rhel9 +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Builds for Red Hat OpenShift | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat Storage 3 | Affected | No fix yet |
| cert-manager Operator for Red Hat OpenShift | Affected | No fix yet |
| RHODF 4.17 for RHEL 9 | Fixed | RHSA-2025:1824 |
| RHODF 4.18 for RHEL 9 | Fixed | RHSA-2025:2652 |
Not affected: 5 products
- RHODF 4.17 for RHEL 9
- RHODF 4.18 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift GitOps
Timeline
- 2026-10-02 Threatist record created from CVE-2025-0426
- 2026-10-03 Alias added: GHSA-jgfp-53c3-624w
References
Advisory 2
More Kubernetes vulnerabilities
- TI-2025-01719 ingress-nginx admission controller RCE escalation CVSS 3.1CRITICAL 9.8
- TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
- TI-2025-00932 ingress-nginx controller - configuration injection via unsanitized mirror annotations CVSS 3.1HIGH 8.8
- TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
- TI-2026-02839 ingress-nginx rewrite-target nginx configuration injection CVSS 3.1HIGH 8.8
- TI-2025-18233 ingress-nginx controller - configuration injection via unsanitized auth-url annotation CVSS 3.1HIGH 8.8
Sources
- CVE-2025-0426 · CVE Program
- CVE-2025-0426 · NVD
- FIRST EPSS
- GHSA-jgfp-53c3-624w · GitHub Advisory Database · CC BY 4.0
- CVE-2025-0426 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences