CVE-2026-122322
Received Received - Intake

Kyverno Unbounded Decompression Memory Exhaustion Vulnerability

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulnCheck

Description
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-122322
EUVD
EUVD-2026-117232

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kyverno kyverno 1.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory exhaustion issue in Kyverno versions 1.11.0 to 1.19.2. It occurs in the extractStatement function where highly compressed gzip attestation layers are decompressed without size limits. Attackers can exploit this by providing oversized compressed layers, causing Kyverno to allocate excessive memory and potentially crash the admission controller via an out-of-memory kill.

Detection Guidance

Monitor Kyverno admission controller logs for out-of-memory (OOM) kills or excessive memory usage during notary attestation processing. Check for registry referrer artifacts with unusually large decompressed sizes compared to their compressed size.

Impact Analysis

This vulnerability can lead to denial of service by crashing Kyverno's admission controller due to memory exhaustion. If exploited, it may cause system instability, disrupt Kubernetes cluster operations, and prevent new workloads from being scheduled until the controller restarts.

Mitigation Strategies

Upgrade Kyverno to version 1.19.2 or later to address the unbounded decompression issue. If immediate upgrade is not possible, enforce size limits on decompressed payloads in the extractStatement function and ensure proper cleanup of uncompressed readers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122322. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...