Summary
Kyverno's policy variable substitution engine (substituteVariablesIfAny in pkg/engine/variables/vars.go) re-scans substituted values for nested {{ ... }} templates in an unbounded loop. When a variable is embedded inside a larger string—such as a validation message—and attacker-controlled data resolves to a value that re-introduces the same variable template, the loop never terminates. This is an incomplete fix for CVE-2025-47281.
Impact
A low-privileged user who can create or update a resource matched by a policy containing string-embedded variable references can permanently hang the webhook goroutine processing that request. Because no per-request evaluation timeout exists in the engine path, the goroutine continues running even after the API server admission timeout expires. Repeating the request exhausts the Kyverno pod's CPU and causes unbounded memory growth as the substituted string expands on each iteration, ultimately resulting in an OOM-kill of the Kyverno pod. This disrupts admission webhook processing for the entire cluster.
Detection
Monitor the Kyverno admission webhook pod for sustained CPU saturation and memory growth that does not recover between admission requests. An OOM-killed Kyverno pod following a period of elevated memory consumption by the webhook is a strong indicator. Review policies containing validation messages or pattern fields that embed {{ request.object.metadata.annotations... }} or similar variable references inside longer string literals, as these are the paths that enable the unbounded growth.
Mitigation
Upgrade Kyverno to version 1.19.2 or later. No workaround is described in the upstream advisory for versions prior to 1.19.2.
Related Security Guidance
References
- GHSA-338x-hgrv-626h — Kyverno unbounded variable substitution DoS — GitHub Security Advisory