---
id: GO-2022-0965
aliases:
  - GHSA-74fp-r6jw-h4mp
title: Unbounded recursion in JSON parsing in k8s.io/apimachinery
summary: Unbounded recursion in JSON parsing in k8s.io/apimachinery
severity: none
vendor: apimachinery
product: k8s.io/apimachinery
ecosystem: go
affected:
  - k8s.io/apimachinery < 0.0.0-20190927203648-9ce6eca90e73
patched:
  - k8s.io/apimachinery 0.0.0-20190927203648-9ce6eca90e73
published: '2022-09-02'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2022-0965'
references:
  - url: 'https://github.com/kubernetes/kubernetes/pull/83261'
  - url: 'https://github.com/advisories/GHSA-pmqp-h87c-mr78'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-11253'
tags:
  - osv
  - go
ingestedAt: '2026-08-07T19:14:18.045Z'
---

## Overview

Unbounded recursion in JSON parsing allows malicious JSON input to cause excessive memory consumption or panics.

## Affected packages

- `k8s.io/apimachinery < 0.0.0-20190927203648-9ce6eca90e73`

## Remediation

Upgrade to a patched release:

- `k8s.io/apimachinery 0.0.0-20190927203648-9ce6eca90e73`