Kyverno: unbounded decompression of notary signature layers exhausts admission controller memory

Impact

FetchSignatureBlob decompresses notary signature layers without bounding the result against maxPayloadSize, so a small gzip layer can expand past memory limits and OOM-kill the admission controller. Affects 1.11.0 up to 1.19.2. This is a separate code path from the attestation-predicate decompression issue (CVE-2026-122322) and has its own advisory, so a cluster that only reads signatures and not attestations is still exposed. The operational effect is the same and just as blunt: admission control for the whole GPU cluster goes away, stopping scheduling under failurePolicy: Fail or waving unverified workloads through under Ignore.

Who can reach it

An attacker who controls registry referrers or signature artifacts that Kyverno fetches during notary verification. NVD records network, unauthenticated (PR:N); practically it needs push access to, or control of, a registry path a policy verifies against.

What to do

Upgrade Kyverno to 1.19.2 or later; patch the deployment and restart the Kyverno controllers - no node drain. Until then, limit verification policies to registries under your control and cap the controller's memory so an OOM kill stays local and recovers, rather than taking reporting down with it.

References

Related entries

• Kyverno: namespaced tenants can template generate rules to write resources into any namespaceCVE-2026-124441 · Kyverno background-controller (generate rule target templating)High
• OpenShift AI Data Science Pipelines Operator: over-broad ClusterRole turns operator compromise into cluster adminCVE-2026-18608 · Red Hat OpenShift AI Data Science Pipelines Operator (ClusterRole)High
• Istio: When JWKS resolution fails, istiod falls back to hardcoded defaults, weakening JWT validationCVE-2026-31837 · IstioHigh
• local-path-provisioner: helper pod template injection yields a privileged pod with host root mountedCVE-2026-44543 · rancher/local-path-provisioner (helperPod.yaml template in local-path-config ConfigMap)High
• Argo CD: application annotations render as unvalidated hrefs, allowing javascript: execution in an admin sessionCVE-2026-45738 · Argo CD UI (application-summary link.argocd.argoproj.io annotation rendering)High
• NGINX Ingress Controller: unsanitized CRD and annotation fields inject arbitrary NGINX directivesCVE-2026-55723 · NGINX Ingress Controller (configuration generator, CRDs and Ingress annotations)High