Memory Exhaustion Vulnerability in Kyverno by Nirmata

CVE-2026-122322

What is CVE-2026-122322?

Kyverno versions from 1.11.0 to 1.19.2 are susceptible to a memory exhaustion vulnerability created by unbounded decompression in the extractStatement function. This flaw allows remote attackers to exhaust system resources by submitting excessively compressed attestation layers. When attackers manipulate registry referrer artifacts to push gzip predicate layers that surpass the maximum payload size, the resulting decompression can lead to Out Of Memory (OOM) kills in the admission controller, ultimately resulting in denial of service conditions.

References