Threats tagged 'ghsa-v92j-7j98-v568'

Kyverno versions prior to 1.19.2 have a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory resources. This occurs because CEL expressions are evaluated without runtime cost limits, enabling attackers to create policies with nested map comprehensions over large ConfigMap fields. Exploitation can cause Kyverno pods to be OOM-killed and block cluster-wide admission.