Kyverno versions before 1.19.2 have a flaw that permits users with namespace-scoped policy creation rights to deploy policies containing specially crafted wildcard patterns. Based on the description, it is inferred that the attacker must create a malicious Policy in a namespace to trigger the vulnerability. These patterns trigger an exponential-time matching routine in the ValidateMatchExcludeConflict function, causing the admission controller to consume excessive CPU. The result is a cluster-wide denial of service that blocks resource operations by causing webhook timeouts. The weakness is classified as CWE-407: Excessive Computation.

This vulnerability affects Kyverno deployments of any version prior to 1.19.2. The flaw exists in the admission controller component that processes policy match and exclude expressions. It is relevant to all Kubernetes clusters running Kyverno for policy enforcement, regardless of the underlying platform or cloud provider.

The CVSS score of 8.3 indicates medium to high severity. EPSS is not available, so estimated exploitation probability cannot be quantified, but the impact is significant because the path requires crafting a policy and the attacker only needs namespace-level permissions. The vulnerability is not listed in the CISA KEV catalog, so there is no known public exploit evidence at the time of analysis. Attackers with the necessary authorization can trigger the CPU spike directly by creating one malicious policy, without needing additional compromises.