Kyverno versions between 1.11.0 and before 1.19.2 have an unbounded decompression bug in the FetchSignatureBlob component. The flaw allows an attacker to supply a highly compressed notary signature layer that expands beyond the configured maximum payload size, exhausting the admission controller’s memory and causing an out‑of‑memory kill. This leads to denial of service and the loss of Kubernetes admission control for the affected cluster. The weakness is a classic case of unbounded memory allocation, classified as a security vulnerability (CWE-409).

The affected product is Kyverno, the Kubernetes policy engine, specifically the 1.11.0 through 1.19.1 releases. All installations of these releases are vulnerable if they process notary signatures from registries they do not fully trust.

The CVSS score of 8.7 indicates a high severity for this vulnerability. EPSS is not available, and the issue is not listed in the CISA KEV catalog, so the current exploitation likelihood is uncertain. However, the description suggests that an attacker must control registry referrers or signature data to trigger the attack, implying that compromised or untrusted registries or malicious CI pipelines could be used. The attack path involves publishing a compressed signature layer that the Kyverno admission controller will decode and decompress during a policy evaluation. If successful, the controller consumes excessive memory, leading to an OOM kill and a temporarily unavailable admission controller, effectively denying all further admission requests. Users with open or public registries exposed to third‑party contributions are at highest risk.