Description
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kyverno | kyverno | 1.11.0 – < 1.19.2 | 1.19.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kyverno-1.17 +1 | No fix yet | — |
Advisories 1
- WID-SEC-2026-4096 Kyverno: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 4, 2026