Summary​

Unbounded memory consumption in Kyverno's policy engine allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables.

Impact​

The random() JMESPath function combined with join() allows exponential string amplification through context variable chaining: l0 = 1 KB → l1 = 2 KB → l2 = 4 KB → ... → l18 = 256 MB. The context evaluation has no cumulative size limit, so any user with permission to create a Policy can author one that exhausts the admission controller's memory and triggers OOMKills, blocking admission for the entire cluster.

Detection​

Audit Policy and ClusterPolicy resources for context blocks that chain join() over previously-computed variables — particularly when the chain is long and each step concatenates a variable to itself. Monitor the kyverno admission controller for memory-pressure signals (OOMKilled events, restart loops, increasing RSS) and correlate restarts with recently-applied policies.

Mitigation​

Upgrade Kyverno to v1.16.3 or v1.15.3 (or later on the matching line).

Workarounds until patched:

• Restrict who can create or update Policy and ClusterPolicy resources via tight RBAC.
• Set memory limits on the kyverno admission and background controller pods (you should already do this) to bound the per-policy blast radius.
• Audit existing policies for the random() + join() amplification pattern and remove anything suspicious.

References​

• GHSA-r2rj-wwm5-x6mq — Kyverno security advisory
• NVD CVE-2026-23881
• DoS Attacks attack vector