CVE-2026-23881

Published: Jan 27, 2026Modified: Feb 2, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno's policy engine that allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.

Affected (2)

Products: Kyverno: Kyverno

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Kyverno Kyverno	Before 1.15.3
Kyverno Kyverno	From 1.16.0 to 1.16.3

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (3)

https://github.com/kyverno/kyverno/commit/7a651be3a8c78dcabfbf4178b8d89026bf3b850f

Source: security-advisories@github.com

Patch

https://github.com/kyverno/kyverno/commit/f5617f60920568a301740485472bf704892175b7

Source: security-advisories@github.com

Patch

https://github.com/kyverno/kyverno/security/advisories/GHSA-r2rj-wwm5-x6mq

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

Timeline

No history available yet.