CVE-2022-31074 - CVE House
Back to Database
Status published Medium CVE-2022-31074

KubeEdge Cloud AdmissionController component DoS

Vulnerability Description

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, several endpoints in the Cloud AdmissionController may be susceptible to a DoS attack if an HTTP request containing a very large Body is sent to it. The consequence of the exhaustion is that the Cloud AdmissionController will be in denial of service. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. There is currently no known workaround.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-31074

Credits & Attribution

No credits recorded in the NVD database.

References

More from kubeedge

View All →
CVE-2022-31080
KubeEdge Websocket Client in package Viaduct: DoS from large response message
Medium 4.4
CVE-2022-31079
KubeEdge Cloud Stream and Edge Stream DoS from large stream message
Medium 4.4
CVE-2022-31078
KubeEdge CloudCore Router memory exhaustion
Medium 4.4
CVE-2022-31077
Malicious response from KubeEdge can crash CSI Driver controller server
Medium 4
CVE-2022-31076
Malicious Message can crash CloudCore in KubeEdge
Medium 4.2

Affected Vendor

Affected Software

kubeedge
Vulnerable Versions:
< 1.9.4, >= 1.10.0, < 1.10.2, = 1.11.0

Timeline

Official Publish: July 11th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact