CVE-2020-8552
Kubernetes API server denial of service
MEDIUM
4.3
CVSS Score
Published: March 27, 2020 at 02:25 PM UTC
Updated: June 17, 2026 at 03:26 AM UTC
2 products affected across 2 vendorsFedoraKubernetes
Using Kubernetes by Kubernetes?
Get instant alerts when new vulnerabilities affect Kubernetes - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM4.3
Exploit prediction
EPSS 3%
Description
The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
95%
v ≤ 1.15.9v < v1.15.10v < v1.16.7v < v1.17.31.16.0 ≤ v ≤ 1.16.61.17.0 ≤ v ≤ 1.17.2
Affected range stops below v1.15.10, so it looks safe — our inference, not a vendor statement
Affected range stops below v1.16.7, so it looks safe — our inference, not a vendor statement
Affected range stops below v1.17.3, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (4)
x_refsource_MISCIssue TrackingPatchThird Party Advisory
Source: [email protected]
https://github.com/kubernetes/kubernetes/issues/89378Vendor Advisoryx_refsource_FEDORA
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
https://security.netapp.com/advisory/ntap-20200413-0003/CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- LOW
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-789CWE-770
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card