---
id: CVE-2026-122323
title: >-
  Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature
  Decompression
summary: >-
  Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression
  vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by
  supplying highly compressed notary signature layers. Attackers who control
  registry refe…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-409
vendor: kyverno
product: kyverno
affected:
  - kyverno >= 1.11.0 < 1.19.2
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T02:25:21.376Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122323'
references:
  - url: 'https://github.com/kyverno/kyverno/security/advisories/GHSA-fr24-3hvf-393q'
    label: GitHub Security Advisory (GHSA-fr24-3hvf-393q)
  - url: >-
      https://www.vulncheck.com/advisories/kyverno-1.11.0-before-1.19.2-memory-exhaustion-via-notary-signature-decompression
    label: >-
      VulnCheck Advisory: Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via
      Notary Signature Decompression
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.692Z'
---

## Overview

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.

## Affected

- `kyverno >= 1.11.0 < 1.19.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.