The vulnerability allows namespace-scoped policy authors to submit CEL expressions without runtime cost limits, causing Kyverno to exhaust CPU and memory, potentially OOM-killing its pods and blocking cluster-wide admission. NamespacedValidatingPolicy or NamespacedDeletingPolicy objects with nested map comprehensions over large ConfigMap fields trigger the denial of service. The weakness is a classic uncontrolled resource consumption flaw (CWE‑400).

Kyverno before version 1.19.2 is affected. All installations of Kyverno that process user‑defined CEL policies are at risk, especially clusters that allow untrusted namespace‑scoped policy authors. No particular OS is enumerated, so any Kubernetes cluster running a vulnerable Kyverno version is impacted.

The CVSS score of 8.2 indicates a High severity impact, yet no EPSS data is available and the vulnerability is not listed in CISA KEV. The exploitation requires the ability to create or modify NamespacedValidatingPolicy or NamespacedDeletingPolicy objects, implying that attackers need namespace-scoped permissions or higher. An attacker can craft policy objects with complex map comprehensions that drive Kyverno to consume excessive CPU and memory, resulting in a denial of service for the entire cluster admission process.