An admission policy fetches Notary attestations for an image whose registry referrers or predicate layers an attacker controls. The cluster must evaluate that image reference. The advisory lists 1.11.0 through 1.16.2 as affected; its original report describes that range as estimated. Versions between that range and the listed fix are not classified by this record.
What is fixed
Kyverno lists 1.19.2 as patched. That release is publicly available; this publication does not re-run the exploit against it.
What to do
Upgrade to Kyverno 1.19.2. Review policies that fetch Notary attestations from registries accepting attacker-controlled artifacts; compressed blob limits alone do not address decompression amplification.
By when
∅not recorded No remediation deadline is specified in the public advisory.
Does not claim: This record does not infer that versions omitted from the advisory range are safe, and does not claim that every image verification policy fetches Notary attestations. All 2 limits
Main mark: ◌claimed · it rates claim c2, not the record as a whole · Scope: Kyverno image verification in the stated admission-controller and registry conditions.
Portfolio updated: 21 Oct 2026 (the last edit of this record set, not a re-check of every upstream source). Status, releases and attribution belong to each source below; none is inferred from another record.
✓verifiedKyverno published GHSA-3f2c-hfj8-542w on 2026-10-21, rates it HIGH (CVSS 3.1: 7.5), lists 1.19.2 as patched, and credits @1seal as reporter.verified · Public advisory page and structured GitHub metadata checked on 2026-10-21. · Kyverno advisory ↗ (external)#c1
◌claimedextractStatement checks compressed descriptor and layer sizes, then buffers the entire Layer.Uncompressed() stream without limiting decompressed bytes. A compact predicate layer can expand beyond the 10,000,000-byte payload limit and exhaust admission-controller memory.claimed · Mechanism documented in the published report; the original reproduction is not re-run for this website update. · Published technical report ↗ (external)#c2
Marks: ✓ verified · ◌ claimed · ✕ contradicted · ∅ not recorded. Where a source exists, it is linked; 1seal does not control it.
What this record does not claim
This record does not infer that versions omitted from the advisory range are safe, and does not claim that every image verification policy fetches Notary attestations.
No exploitation in production or independent retest of the released fix is established by this website update.
Published2026-10-21Added the public Kyverno advisory, source-bound severity and fix metadata, reporter credit and operator guidance. No CVE assigned in this snapshot.
Upstream fixed versions: package name not specified: 1.19.2
patched
details
Finding IDs
F-KY-NOTARY-PANIC-001
GHSA
GHSA-3f2c-hfj8-542w
Status
patched
CWE
CWE-409
Fixed in
1.19.2
Recorded credit
@1seal: reporter (accepted upstream credit). Fixes are maintained by Kyverno; 1seal patch authorship is not claimed.
Disclosure date
Note
The advisory lists 1.11.0 through 1.16.2 as affected; its original report describes that range as estimated. Versions between that range and the listed fix are not classified by this record. An admission policy fetches Notary attestations for an image whose registry referrers or predicate layers an attacker controls. The cluster must evaluate that image reference. extractStatement checks compressed descriptor and layer sizes, then buffers the entire Layer.Uncompressed() stream without limiting decompressed bytes. A compact predicate layer can expand beyond the 10,000,000-byte payload limit and exhaust admission-controller memory. Upgrade to Kyverno 1.19.2. Review policies that fetch Notary attestations from registries accepting attacker-controlled artifacts; compressed blob limits alone do not address decompression amplification. No CVE identifier is assigned in the public advisory snapshot checked on 2026-10-21. The advisory header lists 1.19.2 as patched; the original description still says no patched version was known. This record uses the current structured fix field and the published release.
Recorded severity
high
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS assessment
Kyverno public GitHub advisory; v3.1; 7.5; observed 2026-10-21
Security area (1seal assessment): Availability. Attestation predicate decompression allocates memory without enforcing an uncompressed-size bound. Reviewed 21 Oct 2026.
This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules.
Paper copy does not update. Current version: 1seal.org/research/findings/F-KY-NOTARY-PANIC-001/