---
id: CVE-2020-8552
aliases:
  - GHSA-82hx-w2r5-c2wq
title: Kubernetes API Server DoS Via API Requests
summary: Kubernetes API Server DoS Via API Requests
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
vendor: apiserver
product: k8s.io/apiserver
ecosystem: go
affected:
  - k8s.io/apiserver < 0.15.10
  - 'k8s.io/apiserver >= 0.16.0, < 0.16.7'
  - 'k8s.io/apiserver >= 0.17.0, < 0.17.3'
patched:
  - k8s.io/apiserver 0.15.10
  - k8s.io/apiserver 0.16.7
  - k8s.io/apiserver 0.17.3
published: '2022-02-15'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:11.693834878Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-82hx-w2r5-c2wq'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-8552'
  - url: 'https://github.com/kubernetes/kubernetes/issues/89378'
  - url: 'https://github.com/kubernetes/kubernetes/pull/87669'
  - url: >-
      https://github.com/kubernetes/kubernetes/commit/5978856c4c7f10737a11c9540fe60b8475beecbb
  - url: >-
      https://groups.google.com/forum/#!topic/kubernetes-security-announce/2UOlsba2g0s
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX
  - url: 'https://security.netapp.com/advisory/ntap-20200413-0003'
tags:
  - osv
  - go
epss: 0.02428
epssPercentile: 0.83507
ingestedAt: '2026-09-12T03:13:01.765Z'
---

## Overview

The Kubernetes API server component in Kubernetes versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.

## Affected packages

- `k8s.io/apiserver < 0.15.10`
- `k8s.io/apiserver >= 0.16.0, < 0.16.7`
- `k8s.io/apiserver >= 0.17.0, < 0.17.3`

## Remediation

Upgrade to a patched release:

- `k8s.io/apiserver 0.15.10`
- `k8s.io/apiserver 0.16.7`
- `k8s.io/apiserver 0.17.3`