{"id":"CVE-2026-122322","kind":"vulnerability","aliases":["CVE-2026-122322"],"related":[],"title":"Kyverno: unbounded decompression lets crafted attestations crash admission controller","description":"Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.","summary":"Kyverno versions from 1.11.0 before 1.19.2 decompress attestation layers from container registry referrer artifacts without a size limit. An attacker who can push such artifacts can exhaust memory and get the admission controller OOM-killed, causing denial of service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kubernetes","kyverno","supply-chain"],"not_affected_if":["no-attestation-verification","version-1.19.2-or-later"],"how_to_check":"- Check the installed Kyverno version, for example with `kubectl get deploy -n kyverno -o wide` and the image tag, and compare it against `1.19.2`.\n- Confirm whether Kyverno verifies image attestations (verifyImages rules with attestations) in your policies, since the flaw is in that path.","fix":"- Kyverno: move to `1.19.2` or later (fixed version per the sources).","status":"open","published_at":"2026-11-05T03:17:25+00:00","first_seen_at":"2026-11-05T03:31:42+00:00","triaged_at":"2026-11-05T03:33:11+00:00","updated_at":"2026-11-05T03:33:11+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-05T03:33:11Z","model":"claude-haiku-5-5","output":{"fix":"- Kyverno: move to `1.19.2` or later (fixed version per the sources).","reach":"network","title":"Kyverno: unbounded decompression lets crafted attestations crash admission controller","impact":"medium","summary":"Kyverno versions from 1.11.0 before 1.19.2 decompress attestation layers from container registry referrer artifacts without a size limit. An attacker who can push such artifacts can exhaust memory and get the admission controller OOM-killed, causing denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kyverno","kubernetes","supply-chain"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"admission controller crashes from memory exhaustion, denying cluster admissions","analyst_note":"","how_to_check":"- Check the installed Kyverno version, for example with `kubectl get deploy -n kyverno -o wide` and the image tag, and compare it against `1.19.2`.\n- Confirm whether Kyverno verifies image attestations (verifyImages rules with attestations) in your policies, since the flaw is in that path.","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.19.2-or-later","no-attestation-verification"],"who_is_affected":"Clusters running Kyverno from 1.11.0 before 1.19.2 that verify image attestations, where the registry or a workload can hold attacker-controlled referrer artifacts. Clusters on other versions, or without attestation verification, are less exposed. unknown whether default configurations are affected beyond that.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000728,"input_tokens":4305,"output_tokens":595,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122322':12A,15A '-2026':11A,14A '1.11.0':25B,64C '1.19.2':27B,66C 'admiss':8A,53B,102C 'allow':75C 'artifact':35B,46B,91C 'attack':41B,77C,87C 'attest':6A,29B,85C 'caus':58B,101C 'chain':21B 'compress':84C 'contain':32B,67C 'control':9A,54B,88C,103C 'craft':5A 'crash':7A 'cve':10A,13A 'decompress':3A,28B,70C,100C 'denial':59B,107C 'exceed':97C 'exhaust':48B,79C 'extractstat':73C 'get':51B 'gzip':94C 'high':83C 'infrastructur':16B 'kill':57B,105C 'kubernet':17B 'kyverno':1A,18B,22B,62C 'layer':30B,86C,96C 'let':4A 'limit':39B 'maxpayloads':98C 'memori':49B,80C 'oom':56B,104C 'oom-kil':55B 'predic':95C 'push':44B,93C 'referr':34B,90C 'registri':33B,89C 'remot':76C 'servic':61B,109C 'size':38B 'suppli':20B,82C 'supply-chain':19B 'unbound':2A,69C 'version':23B 'vulner':71C 'without':36B","nicknames":[],"mitigations":[],"who_affected":"Clusters running Kyverno from 1.11.0 before 1.19.2 that verify image attestations, where the registry or a workload can hold attacker-controlled referrer artifacts. Clusters on other versions, or without attestation verification, are less exposed. unknown whether default configurations are affected beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","kubernetes","kyverno","supplychain"],"campaign_type":null,"first_public_at":"2026-10-21T15:58:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122322","severity":null,"published_at":"2026-11-05T03:17:25+00:00","modified_at":"2026-11-05T03:17:25+00:00","first_seen_at":"2026-11-05T03:31:42+00:00","fetched_at":"2026-11-05T03:31:42+00:00","note":null}],"documents":[{"id":72724,"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-3f2c-hfj8-542w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-21T15:58:43+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":72725,"url":"https://www.vulncheck.com/advisories/kyverno-from-1.11.0-before-1.19.2-memory-exhaustion-via-notary-attestation-decompression","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}