Summary
Kyverno routes all wildcard (* / ?) string comparisons through src/ext/wildcard/match.go, a wrapper around github.com/IGLOU-EU/go-wildcard v1.0.3. That library implements matching via a recursive backtracking algorithm derived from MinIO's implementation, which has exponential worst-case complexity. Neither Kyverno nor the library imposes any limit on pattern star count or operand length, and the matcher cannot be interrupted by context cancellation.
Impact
A user who can create a namespaced Kyverno Policy can trigger exponential backtracking in the admission webhook with a single API call by crafting a pattern-value pair that causes the matcher to explore an exponentially large number of paths. A 100-byte pattern matched against a few hundred bytes of annotation or ConfigMap data is sufficient to make a single Match() call effectively unfinishable. Because the goroutine executing the match ignores request deadlines, the Kyverno pod's CPU becomes fully saturated even after the API server times out the admission call. With Kyverno's default failurePolicy: Fail, sustained saturation blocks resource admission cluster-wide.
Detection
Monitor the Kyverno webhook pod for sustained high CPU utilization that does not subside after individual admission request timeouts expire. Admission requests that consistently time out at the API server side while the Kyverno pod remains CPU-bound are an indicator of this condition. Review any recently created namespaced Policies for wildcard patterns (* / ?) in match/exclude rule names, annotation values, or anyPattern fields, particularly patterns with many consecutive *a*a*...*a*b structures.
Mitigation
Upgrade Kyverno to version 1.19.2 or later, which contains a fix for this vulnerability. No workaround is described in the upstream advisory for versions prior to 1.19.2.
Related Security Guidance
References
- GHSA-8mrj-27wr-599g — Kyverno wildcard DoS — GitHub Security Advisory