Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck

CVE-2026-122322Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression

High 7.5

In plain English

A high-severity security flaw in kyverno from kyverno. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 66.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.

Affected products (as reported)

Vendor	Product	Versions
kyverno	kyverno	1.11.0 – before 1.19.2

Weakness: CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-3f2c-hfj8-542w) vendor-advisory
VulnCheck Advisory: Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression third-party-advisory