Skip to content

2026-02-04 — ingress-nginx: validating admission controller memory DoS (CVE-2026-24514)

Product: Kubernetes ingress-nginx (k8s.io/ingress-nginx)

Impact (per advisory): The validating admission controller feature can be driven into excessive memory consumption via large requests, leading to:

  • ingress-nginx controller pod OOMKilled
  • potential node-level memory pressure / instability

Why this matters

Even “just DoS” can be a major security event at the edge: controller downtime can cause widespread outage, failed deployments, or create windows where traffic is routed incorrectly during restart churn.

Affected / fixed versions

Per GitHub advisory: - Affected: < 1.13.7 - Affected: >= 1.14.0, < 1.14.3 - Fixed: 1.13.7 and 1.14.3

  • Upgrade to 1.13.7+ or 1.14.3+.
  • Mitigate exposure:
  • Ensure the validating webhook endpoint is not reachable outside the cluster.
  • Apply Kubernetes API request size limits and/or front the webhook with network policies.
  • Set resource requests/limits appropriately so a single webhook cannot starve the node.

Detection / hunting ideas

  • Look for spikes in admission review payload sizes and ingress-nginx webhook request rates.
  • Monitor for OOMKills/restarts of the ingress-nginx controller.

References