Image verification in an admission-controller deployment fetches Notary signatures or referrers from attacker-controlled registry content. The cluster must evaluate the corresponding image reference. The advisory lists 1.11.0 through 1.16.2 as affected. Versions between that range and the listed fix are not classified by this record.
What is fixed
Kyverno lists 1.19.2 as patched. That release is publicly available; this publication does not re-run the exploit against it.
What to do
Upgrade to Kyverno 1.19.2. Review policies that fetch Notary signatures from registries accepting attacker-controlled artifacts; a compressed-size check is not an uncompressed allocation limit.
By when
∅not recorded No remediation deadline is specified in the public advisory.
Does not claim: This is an availability finding at FetchSignatureBlob, distinct from attestation statement extraction; it does not claim signature forgery or an integrity bypass. All 2 limits
Main mark: ◌claimed · it rates claim c2, not the record as a whole · Scope: Kyverno image verification in the stated admission-controller and registry conditions.
Portfolio updated: 21 Oct 2026 (the last edit of this record set, not a re-check of every upstream source). Status, releases and attribution belong to each source below; none is inferred from another record.
✓verifiedKyverno published GHSA-fr24-3hvf-393q on 2026-10-21, rates it HIGH (CVSS 3.1: 7.5), lists 1.19.2 as patched, and credits @1seal as reporter.verified · Public advisory page and structured GitHub metadata checked on 2026-10-21. · Kyverno advisory ↗ (external)#c1
◌claimedFetchSignatureBlob checks compressed sizes before reading the full Layer.Uncompressed() stream into memory. A small compressed signature layer can therefore expand beyond the 10,000,000-byte payload limit and cause admission-controller memory exhaustion.claimed · Mechanism documented in the published report; the original reproduction is not re-run for this website update. · Published technical report ↗ (external)#c2
Marks: ✓ verified · ◌ claimed · ✕ contradicted · ∅ not recorded. Where a source exists, it is linked; 1seal does not control it.
What this record does not claim
This is an availability finding at FetchSignatureBlob, distinct from attestation statement extraction; it does not claim signature forgery or an integrity bypass.
No exploitation in production or independent retest of the released fix is established by this website update.
Published2026-10-21Added the public Kyverno advisory, source-bound severity and fix metadata, reporter credit and operator guidance. No CVE assigned in this snapshot.
@1seal: reporter (accepted upstream credit). Fixes are maintained by Kyverno; 1seal patch authorship is not claimed.
Disclosure date
Note
The advisory lists 1.11.0 through 1.16.2 as affected. Versions between that range and the listed fix are not classified by this record. Image verification in an admission-controller deployment fetches Notary signatures or referrers from attacker-controlled registry content. The cluster must evaluate the corresponding image reference. FetchSignatureBlob checks compressed sizes before reading the full Layer.Uncompressed() stream into memory. A small compressed signature layer can therefore expand beyond the 10,000,000-byte payload limit and cause admission-controller memory exhaustion. Upgrade to Kyverno 1.19.2. Review policies that fetch Notary signatures from registries accepting attacker-controlled artifacts; a compressed-size check is not an uncompressed allocation limit. No CVE identifier is assigned in the public advisory snapshot checked on 2026-10-21. The advisory header lists 1.19.2 as patched; the original description still says no patched version was known. This record uses the current structured fix field and the published release.
Recorded severity
high
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS assessment
Kyverno public GitHub advisory; v3.1; 7.5; observed 2026-10-21
Upstream title
unbounded decompression in notary signature fetch enables memory exhaustion
Upstream CWE
CWE-409
Upstream publication
Upstream updated
Metadata fetched
Upstream fixed versions
kyverno: 1.19.2
Upstream affected ranges
kyverno: \>= 1.11.0, \<= 1.16.2
Upstream @1seal credit
@1seal: reporter (accepted)
F-KYVERNO-DECOMP-001: Resource limits. Signature blob decompression allocates memory without enforcing an uncompressed-size bound. Reviewed 21 Oct 2026. Mechanism assessed by 1seal.
Security area (1seal assessment): Availability. Signature blob decompression allocates memory without enforcing an uncompressed-size bound. Reviewed 21 Oct 2026.
This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules.
Paper copy does not update. Current version: 1seal.org/research/findings/F-KYVERNO-DECOMP-001/