HIGH 8.7 NVD
CVE-2026-122323
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying h
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.
References
- https://github.com/kyverno/kyverno/security/advisories/GHSA-fr24-3hvf-393q
- https://www.vulncheck.com/advisories/kyverno-1.11.0-before-1.19.2-memory-exhaustion-via-no
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-11-05 via NVD.
vulnfeed aggregates 16624 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.