CVE-2026-122322 in Kyverno
Summary
by MITRE • 11/05/2026
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The Kyverno project, a popular Kubernetes-native policy engine used for enforcing security policies and compliance standards within container orchestration environments, contains a critical unbounded decompression vulnerability in its extractStatement function affecting versions from 1.11.0 up to but not including 1.19.2. This flaw resides specifically in the handling of attestation layers associated with registry referrer artifacts. The core technical issue stems from the lack of proper bounds checking or size validation during the decompression process, allowing an attacker who controls the source registry and its referrer artifacts to supply gzip-compressed predicate layers that are significantly larger than the configured maxPayloadSize limit once they are expanded in memory. This discrepancy between compressed and uncompressed sizes is a classic vector for resource exhaustion attacks, as the system allocates memory based on the decompressed volume without verifying if it exceeds safe operational thresholds before processing begins.
From an operational perspective, this vulnerability poses a severe risk to the stability of Kubernetes clusters running vulnerable versions of Kyverno. When an attacker pushes these oversized compressed layers into a registry that is monitored by the affected Kyverno instance, the admission controller attempts to process and decompress them during policy evaluation or image verification workflows. The excessive memory consumption caused by unbounded decompression quickly leads to Out Of Memory (OOM) conditions within the Kyverno pods. This results in automatic OOM kills initiated by the Kubernetes scheduler, causing the admission controller to restart repeatedly or become entirely unavailable. Such a scenario effectively creates a denial of service condition for the entire cluster's policy enforcement capabilities, potentially allowing unauthorized workloads to be deployed if the admission webhook is down during these outages, thereby undermining the security posture that Kyverno was designed to maintain.
This vulnerability aligns with CWE-787: Out-of-bounds Read and CWE-400: Uncontrolled Resource Consumption in the Common Weakness Enumeration taxonomy, as it involves improper resource management leading to system instability. In terms of offensive cyber operations, this exploit maps directly to MITRE ATT&CK technique T1496: Resource Hijacking, specifically under sub-techniques related to denial of service through resource exhaustion. The attack vector requires the attacker to have control over registry referrer artifacts, which implies a compromise or manipulation of the supply chain upstream from the Kubernetes cluster. This highlights the importance of securing not just the runtime environment but also the integrity and trustworthiness of container registries and their associated metadata services that feed into admission controllers.
Mitigation strategies for this vulnerability involve immediate upgrading to Kyverno version 1.19.2 or later, where the extractStatement function has been patched to enforce strict limits on decompressed payload sizes. Administrators should also implement network-level controls such as Web Application Firewalls (WAF) or registry-side scanning tools that inspect incoming artifacts for anomalous compression ratios before they reach the admission controller. Additionally, configuring Kubernetes resource quotas and limit ranges for Kyverno pods can provide a secondary layer of defense by capping the maximum memory consumption per pod, thereby preventing a single malicious artifact from exhausting node-level resources even if the application logic fails to bound it correctly. Regular auditing of registry access logs and implementing strict image signing policies further reduce the risk surface associated with supply chain attacks targeting admission controllers.