A flaw in the search-v2-api component allows unauthenticated attackers to exploit an unbounded tokenReviews cache by sending requests with unique random bearer tokens. Each unique token creates a permanent cache entry that is not cleared, resulting in memory exhaustion of the search-api pod and causing a denial of service. The vulnerability is due to allocation of resources without limits or throttling (CWE-770).

The vulnerability can cause memory exhaustion of the search-api pod, leading to denial of service and unavailability of the affected component. There is no impact on confidentiality or integrity. The attack requires no privileges or user interaction and can be performed remotely over the network.

Red Hat recommends restricting network access to the search-v2-api component by implementing network policies that limit incoming connections to trusted sources only. This reduces the attack surface for unauthenticated denial-of-service attempts. After applying network policies, the search-v2-api pod should be restarted to apply the new rules. No official patch or fix is explicitly stated in the advisory; thus, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.