{"id":"EM-20261105-38HO","url":"https://cyber.eventmonitor.net/incident/EM-20261105-38HO/kyverno-vulnerability-cve-2026-122322/","type":"cve","title":"Kyverno Vulnerability (CVE-2026-122322)","subtitle":"CVE-2026-122322","subject":"CVE-2026-122322","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T03:17:25.187Z","firstSignal":"2026-11-05T02:25:20.000Z","lastSignal":"2026-11-05T03:17:25.187Z","updated":"2026-11-06T12:16:45.734Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T03:17:25.187Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-05T03:17:25.187Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T02:25:20.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-05T03:17:25.187Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261105-38HO created."}],"stages":[{"name":"Disclosed","at":"2026-11-05T03:17:25.187Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T03:17:25.187Z","detail":"CVSS 8.7 · EPSS 0.4%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-05T02:25:20.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T02:25:20.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-122322 (important)","text":"github.com/kyverno/kyverno: kyverno: Denial of Service via unbounded decompression of attestation layers","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-122322.json"},{"at":"2026-11-05T03:17:25.187Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-122322 (CVSS 8.7)","text":"Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding maxPayloadSize when decompressed, causing admission controller OOM kills and denial of service.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122322"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T03:17:25.187","score":8.7,"severity":"HIGH","desc":"Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding…","product":"","seen":1793900599849},"kev":null,"epss":{"epss":0.00396,"pct":0.33944,"at":1793967405734},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}