{"action":"Upgrade k8s.io/apimachinery to 0.0.0-20190927203648-9ce6eca90e73 or later.","affected":[{"introduced":"0"}],"component":"k8s.io/apimachinery","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["0.0.0-20190927203648-9ce6eca90e73"],"ghsa_id":"GHSA-74fp-r6jw-h4mp","id":"tcs_01M5KF19APWENWZ1A88YAT9M44","modified_at":"2026-08-07T08:12:01.676448217Z","published_at":"2023-02-08T00:35:27Z","references":["https://osv.dev/vulnerability/GHSA-74fp-r6jw-h4mp","https://nvd.nist.gov/vuln/detail/CVE-2019-11253","https://github.com/kubernetes/kubernetes/issues/83253","https://github.com/kubernetes/kubernetes/pull/83261","https://github.com/advisories/GHSA-pmqp-h87c-mr78","https://github.com/kubernetes/kubernetes","https://groups.google.com/g/kubernetes-security-announce/c/jk8polzSUxs","https://pkg.go.dev/vuln/GO-2022-0965","https://stackoverflow.com/questions/58129150/security-yaml-bomb-user-can-restart-kube-api-by-sending-configmap"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-74fp-r6jw-h4mp","url":"https://osv.dev/vulnerability/GHSA-74fp-r6jw-h4mp"}],"summary":"Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing"}