High severity7.5NVD Advisory· Published Nov 5, 2026

CVE-2026-122322

Description

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.

Affected products

Kyverno/Kyvernollm-fuzzy
Range: >=1.11.0,<1.19.2

Patches

Vulnerability mechanics

References

github.com/kyverno/kyverno/security/advisories/GHSA-3f2c-hfj8-542wnvd
www.vulncheck.com/advisories/kyverno-from-1.11.0-before-1.19.2-memory-exhaustion-via-notary-attestation-decompressionnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000