{"id":"EM-20261105-QUJW","url":"https://cyber.eventmonitor.net/incident/EM-20261105-QUJW/kyverno-vulnerability-cve-2026-122323/","type":"cve","title":"Kyverno Vulnerability (CVE-2026-122323)","subtitle":"CVE-2026-122323","subject":"CVE-2026-122323","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T03:17:25.343Z","firstSignal":"2026-11-05T02:25:21.000Z","lastSignal":"2026-11-05T03:17:25.343Z","updated":"2026-11-06T12:16:45.734Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T03:17:25.343Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-05T03:17:25.343Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T02:25:21.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-05T03:17:25.343Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261105-QUJW created."}],"stages":[{"name":"Disclosed","at":"2026-11-05T03:17:25.343Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T03:17:25.343Z","detail":"CVSS 8.7 · EPSS 0.3%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-05T02:25:21.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T02:25:21.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-122323 (important)","text":"github.com/kyverno/kyverno: Kyverno: Denial of Service via unbounded signature decompression","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-122323.json"},{"at":"2026-11-05T03:17:25.343Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-122323 (CVSS 8.7)","text":"Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that decompress beyond maxPayloadSize, causing admission controller OOM kills and denial of service.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122323"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T03:17:25.343","score":8.7,"severity":"HIGH","desc":"Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that…","product":"","seen":1793900599849},"kev":null,"epss":{"epss":0.00337,"pct":0.27203,"at":1793967405734},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}