PT-2026-4956 · Kyverno · Kyverno

Thevilledev · Published 2026-01-27 · Updated 2026-04-16 · CVE-2026-23881

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.16.3 Kyverno versions prior to 1.15.3

Description Kyverno is a policy engine for cloud native platform engineering teams. Affected versions experience unbounded memory consumption within the policy engine. Users with policy creation privileges can trigger a denial of service by creating policies that exponentially amplify string data using context variables. This issue is similar to a 'Billion Laughs' style attack, where an attacker can cause the system to crash by exhausting available memory.

Recommendations Update to Kyverno version 1.16.3 or later. Update to Kyverno version 1.15.3 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-KYVERNO-2026-23881

CLEANSTART-2026-GK29346

CLEANSTART-2026-WB12909

CVE-2026-23881

GHSA-R2RJ-WWM5-X6MQ

GO-2026-4382

SUSE-SU-2026:0403-1

Affected Products

Kyverno

References · 163

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23881.json · Exploit
• https://github.com/kyverno/kyverno/security/advisories/GHSA-r2rj-wwm5-x6mq · Vendor Advisory
• https://github.com/kyverno/kyverno/commit/f5617f60920568a301740485472bf704892175b7 · Patch
• https://github.com/kyverno/kyverno/commit/7a651be3a8c78dcabfbf4178b8d89026bf3b850f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32281 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-15558 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22039 · Security Note
• https://osv.dev/vulnerability/GHSA-r2rj-wwm5-x6mq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33186 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-GK29346 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26958 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32289 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23881 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-66564 · Security Note