High priorityDisclosed

Advisory · CVE-2026-122323

Compressed notary signature layers can exhaust Kyverno's admission controller memory

Kyverno 1.11.0 before 1.19.2 has an unbounded decompression flaw in FetchSignatureBlob: highly compressed notary signature layers can decompress beyond maxPayloadSize, exhausting memory and causing admission controller OOM kills. Kyverno rates it CVSS 4.0 8.7.

Advisory published November 5, 2026Independent summary
Vendor
Kyverno
Product
Kyverno
Identifier / CWE
CVE-2026-122323
CWE-409
Action timing
Immediate
ELI5

Explain it like I’m five

Same trick, different door: a tiny compressed signature layer expands without limit while Kyverno fetches it, and the admission controller runs out of memory.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Compressed signature layer supplied

    An attacker who controls registry referrers or signatures publishes small gzip layers that decompress far beyond maxPayloadSize.

  2. 02Decompression unbounded

    FetchSignatureBlob decompresses the layers without a cap.

  3. 03Memory exhausted

    The admission controller runs out of memory.

  4. 04OOM kill and denial of service

    The controller is OOM-killed, disrupting admission control.

What happened

Kyverno disclosed CVE-2026-122323 for Kyverno 1.11.0 before 1.19.2. An unbounded decompression vulnerability in FetchSignatureBlob lets attackers exhaust memory by supplying highly compressed notary signature layers: attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.

The advisory rates it CVSS 4.0 8.7 and identifies Kyverno 1.19.2 as the fixed release.

What to do

  1. Inventory Kyverno installations and confirm the deployed version.
  2. Upgrade affected installations to Kyverno 1.19.2 or later using the project release guidance.
  3. While remediation is underway, restrict who can publish signatures or referrers to registries Kyverno verifies.
  4. Watch the admission controller for OOM kills and restarts.
  5. Review signature layers in verified registries for unusually compressed content.

Management note

This is the same decompression flaw as the attestation-layer one, in the signature path. Patching covers both, but the operational note is the same: whoever can write to the registry can aim at the controller.