HIGH 8.2 NVD
CVE-2026-122309
Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by submitting CEL express
Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by submitting CEL expressions evaluated without runtime cost limits. Attackers can create a NamespacedValidatingPolicy or NamespacedDeletingPolicy with nested map comprehensions over large ConfigMap fields to OOM-kill Kyverno pods and block cluster-wide admission.
References
- https://github.com/kyverno/kyverno/security/advisories/GHSA-m8p2-qqmx-j53x
- https://www.vulncheck.com/advisories/kyverno-before-1.19.2-denial-of-service-via-unbounded
This high severity vulnerability with a CVSS score of 8.2 was published on 2026-11-05 via NVD.
vulnfeed aggregates 16624 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.