Vulnerabilities

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by…

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Kyverno

Product

kyverno

CVSS v3.1

7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness

CWE-409

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-122323 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 25
   CVE NVD 19h ago

   Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust…

   CVSS 7.5 CVE-2026-122322 Kyverno