CNNVD-202601-4494 Information
CNNVD ID
CNNVD-202601-4494
Related CVE
- CNNVD Published: 2026-01-27
Description (Chinese)
Kyverno是Kyverno开源的一个为 Kubernetes 设计的策略引擎。 Kyverno 1.16.3之前版本和1.15.3之前版本存在安全漏洞，该漏洞源于策略引擎存在无限制内存消耗，可能导致具有策略创建权限的用户通过特制策略造成拒绝服务。
Description (English)
Kyverno is a policy engine designed for Kubernetes by Kyverno open source. There is a security loophole in the pre-Kyverno 1.15.3 and pre-1.15.3 versions, which stems from the unlimited RAM consumption of the strategic engine, which could lead to the rejection of services by users with strategic creation privileges.
Hazard Level
Medium
Vulnerability Type
其他
Affected Vendor
Kyverno
Published
2026-01-27
Last Modified
2026-02-24
References
https://github.com/kyverno/kyverno/commit/f5617f60920568a301740485472bf704892175b7 https://github.com/kyverno/kyverno/security/advisories/GHSA-r2rj-wwm5-x6mq https://github.com/kyverno/kyverno/commit/7a651be3a8c78dcabfbf4178b8d89026bf3b850f https://access.redhat.com/security/cve/cve-2026-23881
Patch
https://github.com/kyverno/kyverno/releases
Share on: