Denial of Service Vulnerability in Ingress-NGINX by Kubernetes
CVE-2026-24514

6.5MEDIUM

Key Information:

Vendor

Kubernetes
Status
Ingress-nginx
Vendor
CVE Published:
3 February 2026

What is CVE-2026-24514?

A security issue has been identified in ingress-nginx where the validating admission controller feature can trigger a denial of service condition. An attacker can exploit this vulnerability by sending oversized requests, leading to excessive memory usage and potentially causing the ingress-nginx controller pod to crash or the host node to run out of memory. This vulnerability underscores the importance of monitoring request sizes and implementing proper resource limits to ensure the stability and availability of Kubernetes environments.

Affected Version(s)

ingress-nginx 0

ingress-nginx 0 < 1.13.7

ingress-nginx 0 < 1.14.3

References

https://github.com/kubernetes/kubernetes/issues/136680

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.