{"id":"GO-2022-0965","aliases":["GHSA-74fp-r6jw-h4mp"],"title":"Unbounded recursion in JSON parsing in k8s.io/apimachinery","summary":"Unbounded recursion in JSON parsing in k8s.io/apimachinery","severity":"none","vendor":"apimachinery","product":"k8s.io/apimachinery","ecosystem":"go","affected":["k8s.io/apimachinery < 0.0.0-20190927203648-9ce6eca90e73"],"patched":["k8s.io/apimachinery 0.0.0-20190927203648-9ce6eca90e73"],"published":"2022-09-02","updated":"2026-08-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2022-0965","references":[{"url":"https://github.com/kubernetes/kubernetes/pull/83261"},{"url":"https://github.com/advisories/GHSA-pmqp-h87c-mr78"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11253"}],"tags":["osv","go"],"ingestedAt":"2026-08-07T19:14:18.045Z","slug":"GO-2022-0965","body":"## Overview\n\nUnbounded recursion in JSON parsing allows malicious JSON input to cause excessive memory consumption or panics.\n\n## Affected packages\n\n- `k8s.io/apimachinery < 0.0.0-20190927203648-9ce6eca90e73`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `k8s.io/apimachinery 0.0.0-20190927203648-9ce6eca90e73`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}