CVE-2026-122323 in Kyverno
Summary
by MITRE • 11/05/2026
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The Kyverno project, a Kubernetes-native policy engine used for enforcing security policies and validating configurations, contains a critical unbounded decompression vulnerability in the FetchSignatureBlob function within versions ranging from 1.11.0 up to but not including 1.19.2. This flaw stems from an insufficient validation of input data size prior to processing compressed payloads. Specifically, when Kyverno processes OCI artifact signatures or attestations during admission control operations, it attempts to decompress gzip layers associated with registry referrers without adequately verifying that the resulting uncompressed data will remain within acceptable memory limits defined by maxPayloadSize. This architectural oversight allows an attacker who has the ability to publish artifacts and their corresponding notary signatures to a container registry to craft maliciously compressed payloads designed to exploit this logic gap.
The technical mechanism of exploitation relies on the properties of gzip compression, particularly when applied to data with high entropy or specifically crafted patterns that result in extreme compression ratios. An attacker can generate small gzip-compressed files that expand into massive amounts of uncompressed data upon decompression. By submitting these optimized payloads as part of container image signatures or attestations, the Kyverno admission controller attempts to process them during pod creation or update requests. Because the system does not enforce a hard limit on the size of the decompressed output before allocating memory for it, the operation consumes excessive amounts of RAM on the node running the Kyverno webhook server. This behavior directly aligns with CWE-787: Out-of-bounds Read and CWE-400: Uncontrolled Resource Consumption, as the system fails to restrict resource allocation based on input characteristics.
The operational impact of this vulnerability is severe, primarily manifesting as a denial of service against the Kubernetes cluster's admission control plane. When Kyverno experiences an out-of-memory condition due to these oversized decompression operations, it triggers OOM kills, causing the webhook server to crash or become unresponsive. Since Kyverno plays a central role in validating and mutating resources before they are admitted into the cluster, its failure effectively disables policy enforcement mechanisms. This creates a window of opportunity where malicious workloads can be deployed without security checks, potentially compromising the integrity and security posture of the entire Kubernetes environment. Furthermore, repeated exploitation attempts can destabilize the control plane nodes if resource limits on the Kyverno pods are not strictly configured to prevent cascading failures across other critical system components.
From a threat intelligence perspective, this vulnerability is relevant to ATT&CK technique T1496: Resource Hijacking and potentially T1059 Command and Scripting Interpreter if leveraged in conjunction with other exploits for initial access or persistence through compromised admission controls. The attack vector requires the attacker to have write access to container registries where Kyverno monitors images, highlighting the importance of securing registry permissions alongside cluster configurations. Mitigation strategies must focus on immediate patching as well as defensive configuration adjustments. Organizations should upgrade Kyverno to version 1.19.2 or later, which includes fixes for this unbounded decompression issue. In environments where upgrading is not immediately feasible, implementing strict resource quotas and limits on the Kyverno deployment pods can help mitigate the impact by preventing a single malicious request from exhausting all available memory on the node. Additionally, configuring admission controllers to reject artifacts with excessively large compressed payloads or limiting the depth of referrer resolution can provide an additional layer of defense against this specific class of decompression attacks.