{"id":"CVE-2026-122322","title":"Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression","summary":"Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry refe…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-409"],"vendor":"kyverno","product":"kyverno","affected":["kyverno >= 1.11.0 < 1.19.2"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T02:25:20.692Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122322","references":[{"url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-3f2c-hfj8-542w","label":"GitHub Security Advisory (GHSA-3f2c-hfj8-542w)"},{"url":"https://www.vulncheck.com/advisories/kyverno-from-1.11.0-before-1.19.2-memory-exhaustion-via-notary-attestation-decompression","label":"VulnCheck Advisory: Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.689Z","slug":"CVE-2026-122322","body":"## Overview\n\nKyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.\n\n## Affected\n\n- `kyverno >= 1.11.0 < 1.19.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}