CVE-2026-122323

EUVD-2026-117233
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.
Data Amplification
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 27.2%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
kyvernokyverno
1.11.0 ≤
𝑥
< 1.19.2
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/kyverno/kyverno/security/advisories/GHSA-fr24-3hvf-393q
https://www.vulncheck.com/advisories/kyverno-1.11.0-before-1.19.2-memory-exhaustion-via-notary-signature-decompression