CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVE-2026-24514
Medium (6.5). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in k8s.io/ingress-nginx 1.13.7, 1.14.3.
A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx controller pod being killed or the node running out of memory.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
- CWE
- CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2pf9-vr92-6h3v | Go | k8s.io/ingress-nginx | <1.13.7 | 1.13.7 |
| GHSA-2pf9-vr92-6h3v | Go | k8s.io/ingress-nginx | >=1.14.0 <1.14.3 | 1.14.3 |
| GO-2026-4417 | Go | k8s.io/ingress-nginx | all versions | no fix published |