CVE-2022-24878: Denial of Service in Kustomize Controller
Summary
CVE-2022-24878: Improper path handling in Kustomization files allows for denial of service. Affects github.com/fluxcd/kustomize-controller versions >= 0.16.0, < 0.24.0. Fixed in 0.24.0. How to fix ↓
Also tracked for
- flux · Bitnami
- github.com/fluxcd/flux2 · Go
- kustomize · Bitnami
The same CVE-2022-24878 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kustomize-controller is a component that enables the use of Kustomize's functionality when applying Kubernetes declarative state onto a cluster. It is written in Go and is part of the Flux project. Kustomize is a tool for customizing Kubernetes YAML configurations. It allows users to define and manage configuration overlays, making it easier to manage and deploy applications in Kubernetes clusters. The kustomize-controller is responsible for applying these customizations to the cluster. However, a vulnerability in the handling of Kustomization files can be exploited to cause a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability arises from improper path handling in Kustomization files. A malicious user can create a specially crafted kustomization.yaml file that triggers an endless loop in the kustomize-controller, resulting in a DoS condition. This vulnerability affects multi-tenancy deployments, as it can prevent multiple tenants from applying their Kustomizations until the malicious file is removed and the controller is restarted. The impact of this vulnerability is that users with write access to a Flux source can disrupt the functioning of the controller, leading to service disruption for other tenants. The vulnerability has a CVSS score of 7.7, indicating a high severity level.
How To Fix
Latest published version: v1.9.6 as of 23 Oct 2026
go get github.com/fluxcd/kustomize-controller@v1.9.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.24.0
This is the first release that contains the fix.
go get github.com/fluxcd/kustomize-controller@v0.24.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the kustomize-controller is vulnerable to a denial of service attack due to improper path handling in Kustomization files. This can be exploited by a malicious user to disrupt the functioning of the controller, affecting multiple tenants in a multi-tenancy deployment. To mitigate this vulnerability, it is recommended to update to the patched versions of kustomize-controller and flux2. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/fluxcd/kustomize-controller →
FAQ
The kustomize-controller is a component of the Flux project that enables the use of Kustomize's functionality when applying Kubernetes declarative state onto a cluster.
Kustomize is a tool for customizing Kubernetes YAML configurations. It allows users to define and manage configuration overlays, making it easier to manage and deploy applications in Kubernetes clusters.
The impact of this vulnerability is that users with write access to a Flux source can craft a malicious kustomization.yaml file that causes the kustomize-controller to enter an endless loop, resulting in a denial of service condition. This can affect multiple tenants in a multi-tenancy deployment, preventing them from applying their Kustomizations until the malicious file is removed and the controller is restarted.
To fix this vulnerability, it is recommended to update to kustomize-controller v0.24.0 or later, and flux2 v0.29.0 or later. These versions include the necessary patches to mitigate the vulnerability.
This vulnerability was found and patched by the Flux engineering team.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fluxcd/kustomize-controller.
