CVE-2026-23881
High · 7.7CVSS
7.7
EPSS
0.6%
Published
Jan 27, 2026
CISA due date
—
The record
Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno's policy engine that allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/kyverno/kyverno | 0 | 1.15.3 |
| Go | github.com/kyverno/kyverno | 1.16.0-rc.1 | 1.16.3 |
| Bitnami | kyverno | 0 | 1.15.3 |
| Chainguard | kyverno-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-background-controller-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-background-controller-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-background-controller-fips-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-background-controller-fips-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-background-controller-fips-1.16 | 0 | 1.16.3-r0 |
| Chainguard | kyverno-cleanup-controller-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-cleanup-controller-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-cleanup-controller-fips-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-cleanup-controller-fips-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-cleanup-controller-fips-1.16 | 0 | 1.16.3-r0 |
| Chainguard | kyverno-cli-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-cli-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-cli-fips-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-cli-fips-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-cli-fips-1.16 | 0 | 1.16.3-r0 |
| Chainguard | kyverno-fips-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-fips-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-fips-1.16 | 0 | 1.16.3-r0 |
| Chainguard | kyverno-init-container-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-init-container-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-init-container-fips-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-init-container-fips-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-init-container-fips-1.16 | 0 | 1.16.3-r0 |
| Chainguard | kyverno-notation-aws | 0 | 1.1-r33 |
| Chainguard | kyverno-notation-aws-fips | 0 | 1.1-r32 |
| Chainguard | kyverno-reports-controller-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-reports-controller-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-reports-controller-fips-1.13 | 0 | 1.13.6-r13 |
| Chainguard | kyverno-reports-controller-fips-1.14 | 0 | 1.14.5-r5 |
| Chainguard | kyverno-reports-controller-fips-1.16 | 0 | 1.16.3-r0 |
| Chainguard | reports-server | 0 | 0 |
| Wolfi | kyverno-1.13 | 0 | 1.13.6-r13 |
| Wolfi | kyverno-1.14 | 0 | 1.14.5-r5 |
| Wolfi | kyverno-background-controller-1.13 | 0 | 1.13.6-r13 |
| Wolfi | kyverno-background-controller-1.14 | 0 | 1.14.5-r5 |
| Wolfi | kyverno-cleanup-controller-1.13 | 0 | 1.13.6-r13 |
| Wolfi | kyverno-cleanup-controller-1.14 | 0 | 1.14.5-r5 |
| Wolfi | kyverno-cli-1.13 | 0 | 1.13.6-r13 |
| Wolfi | kyverno-cli-1.14 | 0 | 1.14.5-r5 |
| Wolfi | kyverno-init-container-1.13 | 0 | 1.13.6-r13 |
| Wolfi | kyverno-init-container-1.14 | 0 | 1.14.5-r5 |
| Wolfi | kyverno-notation-aws | 0 | 1.1-r33 |
| Wolfi | kyverno-reports-controller-1.13 | 0 | 1.13.6-r13 |
| Wolfi | kyverno-reports-controller-1.14 | 0 | 1.14.5-r5 |
| go | github.com/kyverno/kyverno | 1.16.0-rc.1 | 1.16.3 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
Related vulnerabilities
- CVE-2026-22039 Kyverno is a policy engine designed for cloud native platform engineering teams. Also affects github.com/kyverno/kyverno
- GO-2026-4285 Bypassing Kyverno Policies via Double Policy Exceptions in github.com/kyverno/kyverno Also affects github.com/kyverno/kyverno
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects kyverno-1.14
- CVE-2025-11065 A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing… Also affects kyverno-1.14
- CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects kyverno-background-controller-fips-1.14
- CVE-2026-24686 go-tuf is a Go implementation of The Update Framework (TUF). Also affects kyverno-background-controller-fips-1.16
- CVE-2026-24137 sigstore framework is a common go library shared across sigstore services and clients. Also affects kyverno-background-controller-fips-1.16
- CVE-2026-24117 Rekor is a software supply chain transparency log. Also affects kyverno-background-controller-fips-1.16