CVE-2026-122323 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Kyverno versions from 1.11.0 before 1.19.2 decompress notary signature layers without a size limit in FetchSignatureBlob. An attacker who controls registry signatures can publish small gzip layers that expand past the maximum payload size, exhausting memory and causing the admission controller to be OOM-killed.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Clusters running Kyverno from 1.11.0 up to but not including 1.19.2 that verify image signatures or attestations from registries. Exposure depends on whether an untrusted party can push referrers or signatures to an image the admission controller fetches. Clusters on 1.19.2 or later, or without signature verification rules, can skip it.
Not affected if fixed-version, no-verifyimages-rules
Who cares admission-controller, kubernetes, kyverno
kubectl get deploy -n kyverno -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'1.19.2 and below 1.11.0 is not in use1.19.2 or laterKyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.