cur.setReadSize(rl);
            int len = cur.decode(buffer, 0);

            if ( len > rl ) {
                throw new IOException(String.format("WHAT? ( read %d decoded %d ): %s", rl, len, cur));
            }
            else if ( nextCommand != 0 && len > nextCommand ) {
                throw new IOException("Overlapping commands");
            }
            size -= rl;

* Fixed kube-proxy to work correctly with iptables 1.6.2 and later. ([#61734](https://github.com/kubernetes/kubernetes/pull/61734), [@danwinship](https://github.com/danwinship))
* Ensure cloudprovider.InstanceNotFound is reported when the VM is not found on Azure ([#61531](https://github.com/kubernetes/kubernetes/pull/61531), [@feiskyer](https://github.com/feiskyer))

## Known Issues

This section contains a list of known issues reported in Kubernetes 1.8 release. The content is populated via [v1.8.x known issues and FAQ accumulator](https://github.com/kubernetes/kubernetes/issues/53004).

 *  Breaking: Use `kotlin.time.Duration` in APIs like `OkHttpClient.Builder.callTimeout()`. This
    update also drops support for the `DurationUnit` functions introduced in earlier alpha releases
    of OkHttp 5.

 *  Breaking: Reorder the parameters in the Cache constructor that was introduced in 5.0.0-alpha.3.

 *  New: `Request.Builder.cacheUrlOverride()` customizes the cache key used for a request. This can

     *
     * Since we can't ACK settings on the current reader thread (the reader thread can't write) we
     * execute all peer settings logic on the writer thread. This relies on the fact that the
     * writer task queue won't reorder tasks; otherwise settings could be applied in the opposite
     * order than received.
     */
    fun applyAndAckSettings(
      clearPrevious: Boolean,
      settings: Settings,
    ) {
      var delta: Long

	}

	var wg sync.WaitGroup
	// Remove buckets that are in DNS for this server, but aren't local
	for bucket, records := range dnsBuckets {
		if bucketsSet.Contains(bucket) {
			continue
		}

		if globalDomainIPs.Intersection(set.CreateStringSet(getHostsSlice(records)...)).IsEmpty() {
			// This is not for our server, so we can continue
			continue
		}

		wg.Add(1)
		go func(bucket string) {

* Send recycle events from pod to pv. ([#27714](https://github.com/kubernetes/kubernetes/pull/27714), [@jsafrane](https://github.com/jsafrane))
* Limit the number of names per image reported in the node status ([#32914](https://github.com/kubernetes/kubernetes/pull/32914), [@yujuhong](https://github.com/yujuhong))

* Adding lock files for kubeconfig updating ([#28034](https://github.com/kubernetes/kubernetes/pull/28034), [@krousey](https://github.com/krousey))
* federation service controller: fixing the logic to update DNS records ([#27999](https://github.com/kubernetes/kubernetes/pull/27999), [@quinton-hoole](https://github.com/quinton-hoole))

	}

	// Dealing with error returns from close() - 'man 2 close'
	//
	// A careful programmer will check the return value of close(), since it is quite possible that
	// errors on a previous write(2) operation are reported only on the final close() that releases
	// the open file descriptor.
	//
	// Failing to check the return value when closing a file may lead to silent loss of data.

  - kube-apiserver <= v1.21.?

**Fixed Versions**:
  - kube-apiserver v1.25.4
  - kube-apiserver v1.24.8
  - kube-apiserver v1.23.14
  - kube-apiserver v1.22.16

This vulnerability was reported by Richard Turnbull of NCC Group as part of the Kubernetes Audit