Skip to content
Kyverno Vulnerabilities: Memory Exhaustion and Cross-Namespace Issues

Kyverno Vulnerabilities: Memory Exhaustion and Cross-Namespace Issues

First seen 6 Nov 2026, 01:44 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 6, 2026 at 01:45 UTC
  • •Kyverno versions 1.11.0 to before 1.19.2 are vulnerable to memory exhaustion.
  • •Two distinct vulnerabilities involve notary attestation and signature decompression.
  • •A cross-namespace resource read vulnerability is also present in the same versions.

Kyverno versions from 1.11.0 to before 1.19.2 are affected by two vulnerabilities: memory exhaustion via notary attestation decompression and notary signature decompression, both categorized under CWE-409 for improper handling of highly compressed data. These vulnerabilities could lead to significant resource exhaustion, impacting systems utilizing Kyverno for Kubernetes policy management. Additionally, a cross-namespace resource read vulnerability via generate clone was reported for the same versions. The vulnerabilities have been documented in GitHub Security Advisories (GHSA-3f2c-hfj8-542w and GHSA-fr24-3hvf-393q). Users are advised to upgrade to version 1.19.2 or later to mitigate these risks. No has been reported at this time.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-11-06
Vulnerabilities disclosed
Kyverno vulnerabilities related to memory exhaustion and cross-namespace resource read were disclosed, affecting versions 1.11.0 to before 1.19.2.
VulnCheck
2026-11-06
Advisory published
GitHub Security Advisories were published detailing the vulnerabilities and their potential impact.
VulnCheck
2026-11-06
Patch recommended
Users are urged to upgrade to Kyverno version 1.19.2 or later to address the vulnerabilities.
VulnCheck

More articles in this cluster (3)

Extracted Entities (3)

1 / 2

Common questions

Which versions of Kyverno are affected?
Kyverno versions from 1.11.0 to before 1.19.2 are affected by the reported vulnerabilities.
What types of vulnerabilities are present?
The vulnerabilities include memory exhaustion via notary attestation and signature decompression, as well as a cross-namespace resource read issue.
What should I do to protect my systems?
Upgrade to Kyverno version 1.19.2 or later to mitigate the risks associated with these vulnerabilities.