CVE-2026-122322 Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression

What is CVE-2026-122322?

CVE-2026-122322 is a high-severity vulnerability in kyverno, published on 5 Nov 2026.

Official description

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.

Weakness: CWE-409

Which versions are affected by CVE-2026-122322?

It affects 1 product.

Products include Kyverno.

How do I fix CVE-2026-122322?

No fix has been published for CVE-2026-122322 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-122322 being exploited?

There is no known exploitation of CVE-2026-122322 in the wild and no public exploit code.

Other vulnerabilities in kyverno

• CVE-2026-22039 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall Critical 10.0
• CVE-2026-4789 CVE-2026-4789 Critical 9.8
• CVE-2026-122303 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy Critical 9.4
• CVE-2026-122304 Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader Critical 9.4
• CVE-2026-122310 Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-35jw-hw3c-vrw6, GHSA-3f2c-hfj8-542w.