Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck

CVE-2026-122323Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression

High 7.5

In plain English

A high-severity security flaw in kyverno from kyverno. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 72.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.

Affected products (as reported)

Vendor	Product	Versions
kyverno	kyverno	1.11.0 – before 1.19.2

Weakness: CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-fr24-3hvf-393q) vendor-advisory
VulnCheck Advisory: Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression third-party-advisory