CVE-2026-122323: Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Kyverno deployments running versions from 1.11.0 before 1.19.2 are exposed when they process Notary signature layers from registry referrers or signatures controlled by an attacker.
What does an attacker need to exploit it?
An attacker needs the ability to publish or control registry referrers or signatures. They can provide a small gzip-compressed Notary signature layer that expands beyond the intended payload limit.
What is the operational impact?
Decompression can consume enough memory to cause Kyverno admission controller OOM kills, resulting in denial of service.