---
id: CVE-2026-122322
title: >-
  Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation
  Decompression
summary: >-
  Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression
  vulnerability in extractStatement that allows remote attackers to exhaust
  memory by supplying highly compressed attestation layers. Attackers
  controlling registry refe…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-409
vendor: kyverno
product: kyverno
affected:
  - kyverno >= 1.11.0 < 1.19.2
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T02:25:20.692Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122322'
references:
  - url: 'https://github.com/kyverno/kyverno/security/advisories/GHSA-3f2c-hfj8-542w'
    label: GitHub Security Advisory (GHSA-3f2c-hfj8-542w)
  - url: >-
      https://www.vulncheck.com/advisories/kyverno-from-1.11.0-before-1.19.2-memory-exhaustion-via-notary-attestation-decompression
    label: >-
      VulnCheck Advisory: Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion
      via Notary Attestation Decompression
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.689Z'
---

## Overview

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.

## Affected

- `kyverno >= 1.11.0 < 1.19.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.