GitHub Advisoryadvisory · Go

GHSA-2pf9-vr92-6h3v ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling

MEDIUM Published 2026-02-04 Modified 2026-02-04 Official page ↗
Aliases
CVE-2026-24514
Ecosystem
Go
Packages
k8s.io/ingress-nginx
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2026-02-04

Affected packages

• Go k8s.io/ingress-nginx: < 1.13.7 → fixed in 1.13.7 • Go k8s.io/ingress-nginx: >= 1.14.0, < 1.14.3 → fixed in 1.14.3

Description

A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx controller pod being killed or the node running out of memory.

Related

Alias · CVE (1)

  • CVE-2026-24514 A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References