Most recent entries from all

BIT-kyverno-2025-47281 — Kyverno's Improper JMESPath Variable Evaluation Leads to Denial of Service

Affected: Bitnami: kyverno

Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft expressions using the {{@}} variable combined with a pipe and an invalid JMESPath function (e.g., {{@ | non_existent_function }}). This leads to a nil value being substituted into the policy structure. Subsequent processing by internal functions, specifically getValueAsStringMap, which expect string values, results in a panic due to a type assertion failure (interface {} is nil, not string). This crashes Kyverno worker threads in the admission controller and causes continuous crashes of the reports controller pod. This is fixed in version 1.14.2.

CLEANSTART-2026-JI50806 — Security fix for CVE-2025-47281 applied in: kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r9

Affected: CleanStart: kyverno-policy-reporter-kyverno-plugin-fips

Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-248370

fkie_cve-2025-47281

GHSA-r5p3-955p-5ggq — Kyverno's Improper JMESPath Variable Evaluation Lead to Denial of Service

Affected: Go: github.com/kyverno/kyverno

### Summary A Denial of Service (DoS) vulnerability exists in Kyverno due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft expressions using the `{{@}}` variable combined with a pipe and an invalid JMESPath function (e.g., `{{@ | non_existent_function }}`).

This leads to a `nil` value being substituted into the policy structure. Subsequent processing by internal functions, specifically `getValueAsStringMap`, which expect string values, results in a panic due to a type assertion failure (`interface {} is nil, not string`). This crashes Kyverno worker threads in the admission controller (and can lead to full admission controller unavailability in Enforce mode) and causes continuous crashes of the reports controller pod, leading to service degradation or unavailability."

### Details The vulnerability lies in the `getValueAsStringMap` function within `pkg/engine/wildcards/wildcards.go` (specifically around line 138):

```go func getValueAsStringMap(key string, data interface{}) (string, map[string]string) { // ... valMap, ok := val.(map[string]interface{}) // val can be the map containing the nil value // ... for k, v := range valMap { // If valMap contains a key whose value is nil... result[k] = v.(string) // PANIC: v.(string) on a nil interface{} } return patternKey, result } ```

When a policy contains a variable like `{{@ | foo}}` (where `foo` is not a defined…

openSUSE-SU-2025:15405-1 — govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media

govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media