Kyverno: unbounded decompression of attestation predicate layers OOM-kills the admission controller

Impact

extractStatement decompresses gzip predicate layers without enforcing maxPayloadSize against the decompressed size, so a small pushed layer can expand until the admission controller is OOM-killed. Affects 1.11.0 up to 1.19.2. On a GPU cluster, an OOM-killed Kyverno means admission control is unavailable fleet-wide: either new pods stop scheduling (failurePolicy: Fail) or they schedule without policy evaluation (Ignore). An attacker who controls a registry referrer artifact can hold the controller in that state cheaply and repeatedly, because the attack costs them a few kilobytes per attempt while the controller pays the full decompressed size in memory.

Who can reach it

Anyone able to push or control registry referrer artifacts that Kyverno fetches during attestation verification. NVD records the vector as network, unauthenticated (PR:N); in practice it requires write access to, or control over, a registry path referenced by a verification policy.

What to do

Upgrade Kyverno to 1.19.2 or later - an image bump and a restart of the Kyverno controllers, no node drain or reboot. Interim mitigations worth doing anyway: restrict verification policies to registries you control, and give the admission controller a memory limit and restart policy so an OOM is contained rather than cascading.

References

Related entries

• Kyverno: unbounded decompression of notary signature layers exhausts admission controller memoryCVE-2026-122323 · Kyverno notary verification (FetchSignatureBlob gzip signature layer decompression)High
• Kyverno: namespaced tenants can template generate rules to write resources into any namespaceCVE-2026-124441 · Kyverno background-controller (generate rule target templating)High
• OpenShift AI Data Science Pipelines Operator: over-broad ClusterRole turns operator compromise into cluster adminCVE-2026-18608 · Red Hat OpenShift AI Data Science Pipelines Operator (ClusterRole)High
• Istio: When JWKS resolution fails, istiod falls back to hardcoded defaults, weakening JWT validationCVE-2026-31837 · IstioHigh
• local-path-provisioner: helper pod template injection yields a privileged pod with host root mountedCVE-2026-44543 · rancher/local-path-provisioner (helperPod.yaml template in local-path-config ConfigMap)High
• Argo CD: application annotations render as unvalidated hrefs, allowing javascript: execution in an admin sessionCVE-2026-45738 · Argo CD UI (application-summary link.argocd.argoproj.io annotation rendering)High