Threats tagged 'ghsa-vh8f-cmpp-9cv2'

Kyverno versions before 1.19.2 have a denial of service vulnerability in the substituteVariablesIfAny function. This flaw allows low-privileged users to cause the admission webhook to hang by creating self-referential variable templates. The attack triggers unbounded substitution loops that exhaust CPU and memory resources, blocking cluster-wide admission.