Kyverno From 1.11.0 Before 1.19.2 Memory Exhaustion Via Notary Attestation Decompression

Back www.vulncheck.com

Kyverno From 1.11.0 Before 1.19.2 Memory Exhaustion Via Notary Attestation Decompression

www.vulncheck.com • November 6, 2026

Share: View original

Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression

kyverno >= 1.11.0, = 1.11.0, < 1.19.2

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

GitHub Security Advisory (GHSA-3f2c-hfj8-542w)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kyverno Vulnerabilities: Memory Exhaustion and Cross-Namespace Issues Kyverno versions from 1.11.0 to before 1.19.2 are affected by two vulnerabilities: memory exhaustion via notary attestation decompression and notary signature decompression, both categorized under CWE-409 for improper handling of highly compressed data. These vulnerabilities could lead to significant resource exhaustion, impacting systems utilizing Kyverno for Kubernetes policy management. Additionally, a cross-namespace resource read vulnerability via generate clone was reported for the same versions. The vulnerabilities have been documented in GitHub Security Advisories (GHSA-3f2c-hfj8-542w and GHSA-fr24-3hvf-393q). Users are advised to upgrade to version 1.19.2 or later to mitigate these risks. No has been reported at this time. 46

Extracted Entities

Platforms (1)

Vulnerabilities (2)

Data Amplification Notary Attestation Decompression