Loading story…
Kubernetes v1.37 promotes Memory QoS to beta and enables the MemoryQoS feature gate by default on kubelets. On Linux nodes using cgroup v2, the capability uses cgroup memory controls to influence kernel memory management for workloads, including controls such as memory.high and memory reservation mechanisms.
The default memoryThrottlingFactor has changed from 0.9 to null, preventing upgrades from automatically applying memory.high throttling to existing workloads. Operators can explicitly enable throttling, configure node-wide tiered-memory reservations, or disable Memory QoS; Kubernetes cautions that TieredReservation applies to every pod on a node and that hard reservations may account for reclaimable page-cache memory.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Kubernetes introduced Memory QoS as an Alpha feature, providing cgroup-v2-based memory controls for workloads.
Kubernetes v1.37 promoted the MemoryQoS feature gate to Beta and enabled it by default on kubelets. Its default configuration leaves memory throttling and memory reservation disabled unless operators explicitly configure them.
Kubernetes v1.36 expanded Memory QoS with tiered memory reservation, using memory.min and memory.low protections when configured.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kubernetes v1.37 promotes **etcd RangeStream** to beta and enables the `EtcdRangeStream` feature gate by default. With etcd v3.7 or later, the kube-apiserver can consume large collection reads incrementally instead of requiring both etcd and the API server to retain an entire paginated response in memory. The streamed-read path reduces and stabilizes memory usage during large list operations, lowering the risk of out-of-memory failures in control planes managing extensive resource collections. Clusters using older etcd releases remain supported through the existing paginated Range request path; administrators can confirm RangeStream activity through the `listStream` etcd operation metric or disable it explicitly through the feature gate.
Sep 2, 2026
Kubernetes 1.37 advances several platform-security controls, including rootless kubelet operation, short-lived service-account credentials for image pulls, authenticated API-server-to-webhook communication, and hardened volume-mount controls. The release also prohibits static Pods from referencing Secrets or ConfigMaps, while exposing additional API-visible operational and resource-health data that could aid reconnaissance where API permissions are overly broad. The release stabilizes SELinux mount labeling for eligible volumes, completing work initiated under KEP 1710 to mount volumes with the correct SELinux label rather than recursively relabeling every file at container startup. Administrators should test shared-volume labeling scenarios, adopt short-lived credentials, restrict API access, and verify that security tooling supports nftables as kube-proxy warns iptables users ahead of nftables becoming the default in Kubernetes 1.40.
Aug 29, 2026