{"id":"CVE-2026-24514","aliases":["GHSA-2pf9-vr92-6h3v","GO-2026-4417"],"title":"ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling ","summary":"ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling ","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","vendor":"ingress-nginx","product":"k8s.io/ingress-nginx","ecosystem":"go","affected":["k8s.io/ingress-nginx < 1.13.7","k8s.io/ingress-nginx >= 1.14.0, < 1.14.3"],"patched":["k8s.io/ingress-nginx 1.13.7","k8s.io/ingress-nginx 1.14.3"],"published":"2026-02-04","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:33.753756710Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2pf9-vr92-6h3v","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24514"},{"url":"https://github.com/kubernetes/kubernetes/issues/136680"},{"url":"https://github.com/kubernetes/ingress-nginx"}],"tags":["osv","go","exploit-available"],"epss":0.00488,"epssPercentile":0.41148,"exploits":{"github":1,"githubRepos":["https://github.com/mbanyamer/cve-2026-24514-Kubernetes-Dos"],"checkedAt":"2026-09-24T07:53:01.084Z"},"exploitAvailable":true,"ingestedAt":"2026-09-12T03:13:01.746Z","slug":"CVE-2026-24514","body":"## Overview\n\nA security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx controller pod being killed or the node running out of memory.\n\n## Affected packages\n\n- `k8s.io/ingress-nginx < 1.13.7`\n- `k8s.io/ingress-nginx >= 1.14.0, < 1.14.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `k8s.io/ingress-nginx 1.13.7`\n- `k8s.io/ingress-nginx 1.14.3`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}