Threats tagged 'ghsa-vr6x-9fqf-j9vm'

Kyverno versions from 1.11.0 up to but not including 1.19.2 contain an unbounded decompression vulnerability in the FetchSignatureBlob function. This flaw allows attackers who control registry referrers or signatures to supply highly compressed notary signature layers that decompress beyond the configured maximum payload size. Exploiting this can cause the admission controller to consume excessive memory, leading to out-of-memory (OOM) kills and denial of service.