CVE-2026-122323 Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression

What is CVE-2026-122323?

CVE-2026-122323 is a high-severity vulnerability in kyverno, published on 5 Nov 2026.

Official description

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.

Weakness: CWE-409

Which versions are affected by CVE-2026-122323?

It affects 1 product.

Products include Kyverno.

How do I fix CVE-2026-122323?

No fix has been published for CVE-2026-122323 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-122323 being exploited?

There is no known exploitation of CVE-2026-122323 in the wild and no public exploit code.

Other vulnerabilities in kyverno

• CVE-2026-22039 Kyverno Cross-Namespace Privilege Escalation via Policy apiCall Critical 10.0
• CVE-2026-4789 CVE-2026-4789 Critical 9.8
• CVE-2026-122303 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy Critical 9.4
• CVE-2026-122304 Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader Critical 9.4
• CVE-2026-122310 Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-fr24-3hvf-393q, GHSA-vr6x-9fqf-j9vm.