CVE-2026-122323
Received Received - Intake

Kyverno Unbounded Decompression Memory Exhaustion Vulnerability

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulnCheck

Description
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-122323
EUVD
EUVD-2026-117233

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kyverno kyverno 1.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Kyverno versions 1.11.0 to 1.19.2 involves unbounded decompression in the FetchSignatureBlob function. Attackers can craft small compressed notary signature layers that decompress into very large payloads, causing memory exhaustion in the admission controller. This leads to OOM kills and denial of service.

Detection Guidance

Check Kyverno version with 'kyverno version' or 'kubectl get deployment -n kyverno kyverno -o jsonpath='{.spec.template.spec.containers[0].image}''. If version is between 1.11.0 and 1.19.1, the system is vulnerable. Monitor admission controller logs for OOM errors or memory spikes.

Impact Analysis

An attacker who controls registry referrers or signatures can trigger memory exhaustion, causing Kyverno's admission controller to crash. This results in pod OOM kills and denial of service for the Kubernetes cluster, disrupting operations.

Mitigation Strategies

Upgrade Kyverno to version 1.19.2 or later. If upgrading is not possible, restrict access to registry referrers and signatures to prevent attackers from publishing malicious layers. Monitor memory usage of Kyverno pods for signs of exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122323. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...