High Memory Exhaustion Vulnerability in Kyverno Admission Controller
Article Content
- •Two high-severity vulnerabilities in Kyverno can cause memory exhaustion.
- •Attackers can exploit these flaws by supplying malicious image references.
- •No patches are currently available for the affected versions.
Kyverno has disclosed two high-severity vulnerabilities affecting versions 1.11.0 to 1.16.2. The vulnerabilities arise from improper handling of uncompressed data when fetching notary signatures and attestations, allowing attackers to exploit this by supplying malicious image references. This can lead to excessive memory allocation, causing denial of service through pod OOM kills. The vulnerabilities are identified as GHSA-fr24-3hvf-393q and GHSA-3f2c-hfj8-542w, both rated with a CVSS score of 7.5. Currently, no patches are available for these vulnerabilities. Organizations using Kyverno as an admission controller should be aware of the risks associated with image verification and notary attestations.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Common questions
What versions of Kyverno are affected?
What impact do these vulnerabilities have?
Are there any patches available?
Continue Reading
Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects… 
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25…