CVE-2026-122323

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.11.0 through 1.19.1

Description An unbounded decompression issue exists in the FetchSignatureBlob() function. Attackers who control registry referrers or signatures can provide highly compressed notary signature layers. These small gzip layers can decompress beyond the maxPayloadSize variable, leading to memory exhaustion, Out-of-Memory (OOM) kills of the admission controller, and a resulting denial of service.

Recommendations Update Kyverno to version 1.19.2 or later.