The Kubernetes ecosystem has yet again identified a vulnerability that can allow someone to launch an amusingly dubbed “billion laughs” attack.

All joking aside, the vulnerability can allow someone to launch a denial-of-service (DoS) attack against a Kubernetes API server that resides within a container. This then leaves that Kubernetes API service vulnerable to a billion laughs attack. These attacks are a type of DoS attacks aimed at XML documents.

The Kubernetes-specific vulnerability is known as CVE-2019-11253. It has a reserved space on the Common Vulnerabilities and Exposures (CVE) page but full details have not yet been published.

Security firm StackRox noted that a patch has not yet been released. However, there is ongoing discussion of the vulnerability in Kubernetes GitHub page.

StackRox did release a handful of tips to mitigate risk ahead of an expected patch. These include a review of role-based access control (RBAC) policies; auditing of cluster roles and role binding; disabling anonymous access to clusters; and not exposing the Kubernetes API server endpoints on the internet.

The Cloud Native Computing Foundation (CNCF), which houses the Kubernetes project, earlier this year released a security audit that found dozens of security vulnerabilities in the container orchestration platform. These included five high-severity issues and 17 medium-severity issues. Fixes for those issues have already been deployed.

The audit and latest Kubernetes flaw follow the discovery of a handful of vulnerabilities during the past 8 months.

The most pressing was one discovered late last year, which scored an impressive 9.8 (critical) score out of 10 on the Common Vulnerability Scoring System (CVSS).

Another flaw was found in early August, which has been hounding the space for several months.