medium
advisory
Kyverno: Unbounded decompression denial of service (CVE-2026-122322)
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory.
CVE search metadata
CVE search record: CVE-2026-122322. Severity: high. CVSS: 7.5. KEV: no. Product: Kyverno (1.11.0 to 1.19.1). Brief: Kyverno: Unbounded decompression denial of service (CVE-2026-122322). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kyverno-oom-dos/
Triage facts
Revision 1- Applicability
- Kyverno (1.11.0 to 1.19.1)
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 04:27 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Kyverno versions 1.11.0 through 1.19.1 contain an unbounded decompression vulnerability in extractStatement. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.