High priorityDisclosed

Advisory · CVE-2026-122322

Compressed attestation layers can exhaust Kyverno's admission controller memory

Kyverno 1.11.0 before 1.19.2 has an unbounded decompression flaw in extractStatement: highly compressed attestation layers can decompress beyond maxPayloadSize, exhausting memory and causing admission controller OOM kills. Kyverno rates it CVSS 4.0 8.7.

Advisory published November 5, 2026Independent summary
Vendor
Kyverno
Product
Kyverno
Identifier / CWE
CVE-2026-122322
CWE-409
Action timing
Immediate
ELI5

Explain it like I’m five

A tiny compressed file can expand into something enormous. Kyverno unpacks attestation data without a firm limit, so a small upload can eat all the admission controller's memory.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Compressed attestation layer supplied

    An attacker controlling registry referrer artifacts pushes gzip predicate layers that are highly compressed.

  2. 02Decompression unbounded

    extractStatement decompresses the layers beyond maxPayloadSize without a cap.

  3. 03Memory exhausted

    The admission controller runs out of memory.

  4. 04OOM kill and denial of service

    The controller is OOM-killed, disrupting admission control.

What happened

Kyverno disclosed CVE-2026-122322 for Kyverno 1.11.0 before 1.19.2. An unbounded decompression vulnerability in extractStatement lets remote attackers exhaust memory by supplying highly compressed attestation layers: attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.

The advisory rates it CVSS 4.0 8.7 and identifies Kyverno 1.19.2 as the fixed release.

What to do

  1. Inventory Kyverno installations and confirm the deployed version.
  2. Upgrade affected installations to Kyverno 1.19.2 or later using the project release guidance.
  3. While remediation is underway, restrict who can push referrer artifacts to registries Kyverno verifies.
  4. Watch the admission controller for OOM kills and restarts.
  5. Review referrer artifacts in verified registries for unusually compressed layers.

Management note

Decompression bombs are an old trick, and they work because the check happens after the damage. The fix is a size cap; until then, control who can feed Kyverno attestation data.