CVE-2026-122322

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-409

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR15h
🚨High - Kyverno: image-verification cache bypass + unbounded decompression in the admission controller (CVE-2026-122321, CVE-2026-122322, CVE-2026-122323) verifyImages caches verification results keyed by image reference instead of digest, so an attacker who can submit workloads and move a registry tag can warm the cache with a signed image, repoint the tag, and have Kyverno admit the unsigned one — and mutateDigest then pins it. Separately, extractStatement and FetchSignatureBlob decompress attestation and notary layers with no bound, so a small gzip bomb in a registry referrer OOM-kills the admission controller. 👉Affected: Kyverno 1.11.0 – < 1.19.2 (122321: 1.18.0+) | Upgrade to 1.19.2+
0000047
386 followersView on X

Explore more

Back to dashboard