Threats tagged 'ghsa-35jw-hw3c-vrw6'

Kyverno versions from 1.11.0 up to but not including 1.19.2 contain an unbounded decompression vulnerability in the extractStatement function. This flaw allows remote attackers to cause denial of service by exhausting memory resources through highly compressed attestation layers. Specifically, attackers controlling registry referrer artifacts can push gzip predicate layers that exceed the maximum payload size when decompressed, leading to out-of-memory (OOM) kills of the admission controller.