VDB
CVE-2026-23881
CVE-2026-23881
PUBLISHED
CVSS 6.5 MEDIUM
Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno's policy engine that allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.
EPSS 0.54% · 43.4th percentile
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.54%
43.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | kyverno | 0, 1.16.0 |
| Bitnami | kyverno | 0, 1.16.0 |
Timeline
- Jan 27, 2026 CVE Published
- Jan 27, 2026 PoC Published
- Jan 28, 2026 EPSS Score
- Jan 29, 2026 CVE Updated
- Jan 30, 2026 Security Advisory
- Jan 31, 2026 EPSS Score
- Feb 2, 2026 EPSS Score
- Feb 5, 2026 EPSS Score
- Feb 8, 2026 EPSS Score
- Feb 10, 2026 EPSS Score
- Feb 13, 2026 EPSS Score
- Feb 16, 2026 EPSS Score
References
- https://github.com/kyverno/kyverno/commit/f5617f60920568a301740485472bf704892175b7 fix
- https://github.com/kyverno/kyverno/commit/7a651be3a8c78dcabfbf4178b8d89026bf3b850f fix
- https://github.com/kyverno/kyverno/security/advisories/GHSA-r2rj-wwm5-x6mq url
- https://nvd.nist.gov/vuln/detail/CVE-2026-23881 url