{"id":"CVE-2026-122309","title":"Kyverno before 1.19.2 Denial of Service via Unbounded CEL Policy Evaluation Cost","summary":"Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by submitting CEL expressions evaluated without runtime cost limits. Attackers can create a Namespaced…","severity":"medium","cvss":6.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-400"],"vendor":"kyverno","product":"kyverno","affected":["kyverno < 1.19.2"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T02:25:12.280Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122309","references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-m8p2-qqmx-j53x","label":"GitHub Security Advisory (GHSA-m8p2-qqmx-j53x)"},{"url":"https://www.vulncheck.com/advisories/kyverno-before-1.19.2-denial-of-service-via-unbounded-cel-policy-evaluation-cost","label":"VulnCheck Advisory: Kyverno before 1.19.2 Denial of Service via Unbounded CEL Policy Evaluation Cost"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.686Z","epss":0.00197,"epssPercentile":0.09483,"slug":"CVE-2026-122309","body":"## Overview\n\nKyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by submitting CEL expressions evaluated without runtime cost limits. Attackers can create a NamespacedValidatingPolicy or NamespacedDeletingPolicy with nested map comprehensions over large ConfigMap fields to OOM-kill Kyverno pods and block cluster-wide admission.\n\n## Affected\n\n- `kyverno < 1.19.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":34.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}