Loading vulnerability…
Denial of Service in ingress-nginx Validating Admission Controller
CVE-2026-24514 is a resource-exhaustion vulnerability in the ingress-nginx validating admission controller. Unbounded request-body reading allows large requests to trigger excessive memory consumption, potentially causing the ingress-nginx controller pod to be killed or the hosting node to run out of memory. Fixed releases are 1.13.7 in the 1.13.x branch and 1.14.3 in the 1.14.x branch.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disrupt ingress-nginx availability by exhausting controller memory and causing pod termination. Memory exhaustion on the hosting node may also affect other workloads. Repeated requests can prolong the denial of service. No confidentiality or integrity impact is established.
If you can’t patch tonight, do this now.
Until upgrading, restrict network access to the validating admission controller to the Kubernetes API server and other explicitly authorized clients. Where supported, enforce request-body size limits and traffic controls before requests reach the admission controller. Tighten admission-related access permissions, but do not rely on Kubernetes RBAC alone to prevent direct network requests to the webhook.
Patch, then assume compromise.
Upgrade ingress-nginx to version 1.13.7 or later in the 1.13.x branch, or version 1.14.3 or later in the 1.14.x branch.
1 exploit validated by Mallory's analysis.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.