{"id":"CVE-2026-122323","kind":"vulnerability","aliases":["CVE-2026-122323"],"related":[],"title":"Kyverno: unbounded decompression in signature fetch lets attackers crash admission controller","description":"Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.","summary":"Kyverno versions from 1.11.0 before 1.19.2 decompress notary signature layers without a size limit in FetchSignatureBlob. An attacker who controls registry signatures can publish small gzip layers that expand past the maximum payload size, exhausting memory and causing the admission controller to be OOM-killed.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["admission-controller","infrastructure","kubernetes","kyverno"],"not_affected_if":["fixed-version","no-verifyimages-rules"],"how_to_check":"- Check the Kyverno version running in the cluster, e.g. `kubectl get deploy -n kyverno -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'`\n- Confirm whether the image tag is at or above `1.19.2` and below `1.11.0` is not in use\n- Check whether Kyverno verifies image signatures from registries that untrusted parties can write to (verifyImages rules)","fix":"- Kyverno: upgrade to `1.19.2` or later","status":"open","published_at":"2026-11-05T03:17:25+00:00","first_seen_at":"2026-11-05T03:31:42+00:00","triaged_at":"2026-11-05T03:33:11+00:00","updated_at":"2026-11-05T03:33:11+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-05T03:33:11Z","model":"claude-haiku-5-5","output":{"fix":"- Kyverno: upgrade to `1.19.2` or later","reach":"network","title":"Kyverno: unbounded decompression in signature fetch lets attackers crash admission controller","impact":"medium","summary":"Kyverno versions from 1.11.0 before 1.19.2 decompress notary signature layers without a size limit in FetchSignatureBlob. An attacker who controls registry signatures can publish small gzip layers that expand past the maximum payload size, exhausting memory and causing the admission controller to be OOM-killed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kyverno","kubernetes","admission-controller"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"admission controller crashes from memory exhaustion, denying service","analyst_note":"","how_to_check":"- Check the Kyverno version running in the cluster, e.g. `kubectl get deploy -n kyverno -o jsonpath='{.items[*].spec.template.spec.containers[*].image}'`\n- Confirm whether the image tag is at or above `1.19.2` and below `1.11.0` is not in use\n- Check whether Kyverno verifies image signatures from registries that untrusted parties can write to (verifyImages rules)","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-verifyimages-rules"],"who_is_affected":"Clusters running Kyverno from 1.11.0 up to but not including 1.19.2 that verify image signatures or attestations from registries. Exposure depends on whether an untrusted party can push referrers or signatures to an image the admission controller fetches. Clusters on 1.19.2 or later, or without signature verification rules, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000756,"input_tokens":4308,"output_tokens":650,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122323':14A,17A '-2026':13A,16A '1.11.0':27B,72C '1.19.2':29B,74C 'admiss':10A,19B,63B,112C 'admission-control':18B 'allow':83C 'attack':8A,41B,84C,95C 'beyond':109C 'caus':61B,111C 'compress':91C 'contain':75C 'control':11A,20B,43B,64B,97C,113C 'crash':9A 'cve':12A,15A 'decompress':3A,30B,78C,108C 'denial':117C 'exhaust':58B,86C 'expand':52B 'fetch':6A 'fetchsignatureblob':39B,81C 'gzip':49B,105C 'high':90C 'infrastructur':21B 'kill':69B,115C 'kubernet':22B 'kyverno':1A,23B,24B,70C 'layer':33B,50B,94C,106C 'let':7A 'limit':37B 'maximum':55B 'maxpayloads':110C 'memori':59B,87C 'notari':31B,92C 'oom':68B,114C 'oom-kil':67B 'past':53B 'payload':56B 'publish':47B,103C 'referr':99C 'registri':44B,98C 'servic':119C 'signatur':5A,32B,45B,93C,101C 'size':36B,57B 'small':48B,104C 'suppli':89C 'unbound':2A,77C 'version':25B 'vulner':79C 'without':34B","nicknames":[],"mitigations":[],"who_affected":"Clusters running Kyverno from 1.11.0 up to but not including 1.19.2 that verify image signatures or attestations from registries. Exposure depends on whether an untrusted party can push referrers or signatures to an image the admission controller fetches. Clusters on 1.19.2 or later, or without signature verification rules, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["admissioncontroller","high","infrastructure","kubernetes","kyverno"],"campaign_type":null,"first_public_at":"2026-10-21T15:58:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122323","severity":null,"published_at":"2026-11-05T03:17:25+00:00","modified_at":"2026-11-05T03:17:25+00:00","first_seen_at":"2026-11-05T03:31:42+00:00","fetched_at":"2026-11-05T03:31:42+00:00","note":null}],"documents":[{"id":72726,"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-fr24-3hvf-393q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-21T15:58:59+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":72727,"url":"https://www.vulncheck.com/advisories/kyverno-1.11.0-before-1.19.2-memory-exhaustion-via-notary-signature-decompression","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}