CVE-2020-8552: Allocation of Resources Without Limits or Throttling and Uncontrolled Memory Allocation in Kubernetes
Summary
CVE-2020-8552: Kubernetes API Server DoS Via API Requests. Affects k8s.io/apiserver across 3 version ranges.
< 0.15.10
>= 0.16.0, < 0.16.7
>= 0.17.0, < 0.17.3
Fixed in 0.15.10, 0.16.7 or 0.17.3, depending on the release line you run. How to fix ↓
Also tracked for
- kubernetes · Debian:11
The same CVE-2020-8552 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kubernetes API server component is a critical part of the Kubernetes system that handles API requests and manages resources. It is responsible for authenticating and authorizing requests, as well as enforcing policies and managing cluster-wide resources. The vulnerability identified as CVE-2020-8552 affects versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 of the Kubernetes API server. This vulnerability allows an attacker to launch a denial of service attack by sending malicious API requests that can exhaust system resources and cause the API server to become unresponsive.
Vulnerability Detail
The vulnerability arises from a lack of resource limits or throttling in the Kubernetes API server. This means that an attacker can send a large number of API requests without any restrictions, leading to excessive consumption of system resources such as CPU, memory, and network bandwidth. As a result, the API server becomes overwhelmed and unable to process legitimate requests, causing a denial of service. The impact of this vulnerability can range from temporary unavailability of the API server to a complete system outage, depending on the severity of the attack and the resources available.
How To Fix
Latest published version: v0.37.1 as of 23 Oct 2026
go get k8s.io/apiserver@v0.37.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.15.100.15.10go get k8s.io/apiserver@v0.15.10 -
>= 0.16.0, < 0.16.70.16.7go get k8s.io/apiserver@v0.16.7 -
>= 0.17.0, < 0.17.30.17.3go get k8s.io/apiserver@v0.17.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is possible to implement rate limiting or throttling mechanisms at the network level to restrict the number of API requests that can be processed by the Kubernetes API server. This can help mitigate the impact of the vulnerability by limiting the resources consumed by malicious requests. However, it is important to note that this workaround may affect the overall performance and responsiveness of the API server, so it should be used with caution and as a temporary measure until the upgrade to the fixed version is completed.
Conclusion
The vulnerability identified as CVE-2020-8552 in the Kubernetes API server can lead to a denial of service attack by exhausting system resources. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of the Kubernetes API server. Additionally, implementing rate limiting or throttling mechanisms at the network level can provide temporary mitigation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for k8s.io/apiserver →
FAQ
The vulnerability allows an attacker to launch a denial of service attack on the Kubernetes API server, potentially leading to temporary unavailability or complete system outage.
You can use the Vulert Playground at Vulert Scanner to check if your Kubernetes cluster is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including CVE-2020-8552, are detected.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to apply the necessary patches and upgrades to prevent any potential attacks.
While upgrading to the fixed versions is the recommended approach, you can implement rate limiting or throttling mechanisms at the network level to restrict the impact of the vulnerability. However, this should be considered a temporary workaround until the upgrade is completed.
You can find more information about the vulnerability, including the technical details and the fixed versions, in the advisory available at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-82hx-w2r5-c2wq/GHSA-82hx-w2r5-c2wq.json
