Skip to content
Sign in
3.3 Low

CVE-2026-114236 Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

Description

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit

CVSS 3.1 detail

Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Exploitable with local access to the machine, without an account and if a user takes an action; the impact on data or service is limited.

Attack vector
Local
Attack complexity
Low
Privileges required
None
Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Affected products and versions

Product Affected versions Fixed in
Confidential Compute Attestation Versions not published
DPU kit for NVIDIA Versions not published
Exploit Intelligence Versions not published
Multicluster Engine for Kubernetes Versions not published
NVIDIA JetPack 6 for RHEL Versions not published
OpenShift Lightspeed Versions not published
OpenShift Source-to-Image (S2I) Versions not published
Red Hat Advanced Cluster Security 4 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Show the 13 other branches
Product Affected versions Fixed in
Red Hat Build of Podman Desktop Versions not published
Red Hat Certification Program for Red Hat Enterprise Linux 9 Versions not published
Red Hat Developer Hub Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Hardened Images Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat OpenStack Platform 18.0 Versions not published
Red Hat Quay 3 Versions not published
Red Hat Developer Hub 1 Versions not published
Red Hat OpenShift Container Platform 5 Versions not published

Other CVEs of Confidential Compute Attestation

The 43 CVEs of Confidential Compute Attestation →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-92574 Cri-o: cri-o checkpoint restore bypasses destination security context 8.8 High CVE-2026-92925 Redis: redis: out-of-bounds read via crafted cluster bus packets 7.1 High CVE-2026-42784 Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion 7.4 High
Track this CVE