Kyverno’s substituteVariablesIfAny function contains a loop that can run indefinitely when annotations reference the policy variable itself. A low‑privileged user can craft a resource whose annotation re‑introduces this variable, causing the webhook to cycle through substitutions, consume CPU and memory, and halt admission of new resources cluster‑wide.

Kyverno versions before 1.19.2 are vulnerable. The issue is present in any Kyverno deployment that uses the admission webhook to process custom resource annotations.

The CVSS score of 8.3 signals high severity. The exploit requires only the ability to create resources with specific annotations, without elevated privileges. While the EPSS score is not available and the vulnerability is not listed in CISA KEV, the clear attack path suggests that ordinary cluster users could trigger the denial‑of‑service condition.