CVE-2026-122323
Description
A flaw was found in Kyverno. An attacker who controls container registry referrers or signatures can trigger a Denial of Service (DoS) by supplying specially crafted, highly compressed signature layers. When Kyverno decompresses these payloads, it fails to enforce size limits, resulting in memory exhaustion and causing the admission controller to crash due to out-of-memory (OOM) conditions.
Statement
This vulnerability is rated as Important because an untrusted actor can remotely trigger out-of-memory termination of the admission controller service, disrupting cluster policy enforcement without needing administrative access. Red Hat OpenShift does not provide or enable Kyverno by default, utilizing native admission webhooks and Red Hat Advanced Cluster Management for policy enforcement. Risk is limited to clusters where Kyverno is independently deployed and configured to validate container image signatures originating from untrusted registries.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce decompression size limits on notary signature blobs in Kyverno to prevent unbounded memory allocation: upgrade to Kyverno 1.19.2+ (or the corresponding fixed Red Hat builds), which cap uncompressed signature reads with a limit reader to enforce maxPayloadSize during decompression, closing all 2 injection vectors (crafted gzip-compressed signature layer, malicious container registry referrers). Until patched, this is a concern on Kyverno admission controller deployments configured to verify notary image signatures, so restrict admission verification policies to trusted container registries and prevent untrusted actors from publishing registry referrers or signatures evaluated by Kyverno. As a compensating measure, monitor cgroup memory pressure metrics using memory.events and PSI to detect sudden memory surges and impending OOM kills during signature decompression. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded decompression defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
