---
id: "CVE-2026-122322"
kind: "vulnerability"
aliases: ["CVE-2026-122322"]
title: "Kyverno: unbounded decompression lets crafted attestations crash admission controller"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kubernetes", "kyverno", "supply-chain"]
not_affected_if: ["no-attestation-verification", "version-1.19.2-or-later"]
published_at: "2026-11-05T03:17:25+00:00"
first_seen_at: "2026-11-05T03:31:42+00:00"
updated_at: "2026-11-05T03:33:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122322", "first_seen_at": "2026-11-05T03:31:42+00:00"}]
exploit_sources: []
---

# Kyverno: unbounded decompression lets crafted attestations crash admission controller

Kyverno versions from 1.11.0 before 1.19.2 decompress attestation layers from container registry referrer artifacts without a size limit. An attacker who can push such artifacts can exhaust memory and get the admission controller OOM-killed, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kyverno version, for example with `kubectl get deploy -n kyverno -o wide` and the image tag, and compare it against `1.19.2`.
- Confirm whether Kyverno verifies image attestations (verifyImages rules with attestations) in your policies, since the flaw is in that path.

## Fix

- Kyverno: move to `1.19.2` or later (fixed version per the sources).

## Timeline

- 2026-11-05T03:31:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122322

## Documents

- [advisory] Vendor advisory: github.com https://github.com/kyverno/kyverno/security/advisories/GHSA-3f2c-hfj8-542w
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/kyverno-from-1.11.0-before-1.19.2-memory-exhaustion-via-notary-attestation-decompression

## From the sources

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_