BIT-flux-2022-39272

    Dashboard / Vulnerabilities / BIT-flux-2022-39272

    BIT-flux-2022-39272

    Published: 2 Dec 2025Last Modified: 8 Sept 2026

    Summary: Flux2 vulnerable to Denial of Service due to Improper use of metav1.Duration

    Details: Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a Denial of Service. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed. This issue is patched in version 0.35.0. As a workaround, Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.

    References: https://github.com/fluxcd/flux2/security/advisories/GHSA-f4p5-x4vc-mh4v, https://github.com/kubernetes/apimachinery/issues/131, https://nvd.nist.gov/vuln/detail/CVE-2022-39272

    Affected packages

    Package

    Name: flux

    Purl: pkg:bitnami/flux

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.1.0
    Fixed -0.35.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High