https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T17:17:49.407625+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-188474 EUVD-2026-188474 2026-10-06T17:17:49.457087+00:00 EUVD-2026-188474 https://cve.radiocsirt.org/vuln/fkie_cve-2023-32187 fkie_cve-2023-32187 2026-10-06T17:17:49.457121+00:00

An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.0 before v1.25.13+k3s1, from v1.26.0 before v1.26.8+k3s1, from sev1.27.0 before v1.27.5+k3s1, from v1.28.0 before v1.28.1+k3s1.

 https://cve.radiocsirt.org/vuln/ghsa-m4hf-6vgr-75r2 GHSA-m4hf-6vgr-75r2 — K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack 2026-10-06T17:17:49.457158+00:00

Affected: Go: github.com/k3s-io/k3s

### Impact

An issue was found in K3s where an attacker with network access to K3s servers' apiserver/supervisor port (TCP 6443) can force the TLS server to add entries to the certificate's Subject Alternative Name (SAN) list, through a stuffing attack, until the certificate grows so large that it exceeds the maximum size allowed by TLS client implementations. OpenSSL for example will raise an `excessive message size` error when this occurs. No authentication is necessary to perform this attack, only the ability to perform a TLS handshake against the apiserver/supervisor port (TCP 6443).

Affected servers will continue to operate, but clients (including both external administrative access with `kubectl` and server or agent nodes) will fail to establish new connections, thus leading to a denial of service (DoS) attack.

### Remediation

Upgrade to a fixed release:

- v1.28.1+k3s1 - v1.27.5+k3s1 - v1.26.8+k3s1 - v1.25.13+k3s1 - v1.24.17+k3s1

If you are using K3s 1.27 or earlier, you must also add the parameter `tls-san-security: true` to the K3s configuration to enable enhanced security for the supervisor's TLS SAN list. This option defaults to `true` starting with K3s 1.28.

Note that this flag changes the behavior of K3s servers. You should ensure that you configure `node-external-ip` on servers that will be connected to via an external IP, and add `tls-san` entries for any load-balancers or VIP addresses that will be associated with the supervisor port. External IPs and l…

 https://cve.radiocsirt.org/vuln/gsd-2023-32187 gsd-2023-32187 2026-10-06T17:17:49.457215+00:00 gsd-2023-32187 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2303 WID-SEC-W-2023-2303 — Kubernetes: Schwachstelle ermöglicht Denial of Service 2026-10-06T17:17:49.457228+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Kubernetes ausnutzen, um einen Denial of Service Angriff durchzuführen.