func getCpObjMetadataFromHeader(ctx context.Context, r *http.Request, userMeta map[string]string) (map[string]string, error) {
	// Make a copy of the supplied metadata to avoid
	// to change the original one.
	defaultMeta := make(map[string]string, len(userMeta))
	for k, v := range userMeta {
		// skip tier metadata when copying metadata from source object
		switch k {

There is no mitigation from this issue.  Cluster admins should take care to secure aggregated API servers and should not grant access to mutate `APIService`s to untrusted parties.

**Affected Versions**:
  - kube-apiserver v1.25.0
  - kube-apiserver v1.24.0 - v1.24.4

"teto", "bylo", "kde", "ke", "pravé", "ji", "nad", "nejsou", "či", "pod", "téma", "mezi", "přes", "ty", "pak", "vám", "ani", "když", "však", "neg", "jsem", "tento", "článku", "články", "aby", "jsme", "před", "pta", "jejich", "byl", "ještě", "až", "bez", "také", "pouze", "první", "vaše", "která", "nás", "nový", "tipy", "pokud", "může", "strana", "jeho", "své", "jiné", "zprávy", "nové", "není", "vás", "jen", "podle", "zde", "už", "být", "více", "bude", "již", "než", "který", "by", "které", "co", "nebo", "ten",...

"teto", "bylo", "kde", "ke", "pravé", "ji", "nad", "nejsou", "či", "pod", "téma", "mezi", "přes", "ty", "pak", "vám", "ani", "když", "však", "neg", "jsem", "tento", "článku", "články", "aby", "jsme", "před", "pta", "jejich", "byl", "ještě", "až", "bez", "také", "pouze", "první", "vaše", "která", "nás", "nový", "tipy", "pokud", "může", "strana", "jeho", "své", "jiné", "zprávy", "nové", "není", "vás", "jen", "podle", "zde", "už", "být", "více", "bude", "již", "než", "který", "by", "které", "co", "nebo", "ten",...

  - Aggregated discovery requests can now timeout. Aggregated API servers must complete discovery calls within 5 seconds (other requests can take longer). Use the feature gate `EnableAggregatedDiscoveryTimeout=false` to temporarily revert behavior to the previous 30 second timeout if required (the temporary `EnableAggregatedDiscoveryTimeout` feature gate will be removed in v1.17). ([#82146]...

## Changes by Kind

### API Change

- Make STS available replicas optional again, ([#109241](https://github.com/kubernetes/kubernetes/pull/109241), [@ravisantoshgudimetla](https://github.com/ravisantoshgudimetla)) [SIG API Machinery and Apps]

HSPLokio/SegmentPool;-><clinit>()V
HSPLokio/SegmentPool;-><init>()V
HSPLokio/SegmentPool;->firstRef()Ljava/util/concurrent/atomic/AtomicReference;
HSPLokio/SegmentPool;->recycle(Lokio/Segment;)V
HSPLokio/SegmentPool;->take()Lokio/Segment;
HSPLokio/SocketAsyncTimeout;-><init>(Ljava/net/Socket;)V
HSPLokio/Timeout$Companion$NONE$1;-><init>()V
HSPLokio/Timeout;-><clinit>()V
HSPLokio/Timeout;-><init>()V
HSPLokio/Timeout;->throwIfReached()V

- Make Azure clients only retry on specified HTTP status codes ([#88017](https://github.com/kubernetes/kubernetes/pull/88017), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider]

* Make DaemonSet respect critical pods annotation when scheduling. ([#42028](https://github.com/kubernetes/kubernetes/pull/42028), [@janetkuo](https://github.com/janetkuo))
* Implement the update feature for DaemonSet. ([#41116](https://github.com/kubernetes/kubernetes/pull/41116), [@lukaszo](https://github.com/lukaszo))

- Make decoding etcd's response respect the timeout context. ([#121815](https://github.com/kubernetes/kubernetes/pull/121815), [@HirazawaUi](https://github.com/HirazawaUi)) [SIG API Machinery]