Log in Start free

Vulnerability · Published Oct 21, 2026 · Assigned by redhat

CVE-2026-114236Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

Low 3.3

In plain English

A low-severity security flaw in Confidential Compute Attestation from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.1%top 99.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit

Affected products (as reported)

VendorProductVersions
Red Hat Confidential Compute Attestation see references
Red Hat DPU kit for NVIDIA see references
Red Hat Exploit Intelligence see references
Red Hat Multicluster Engine for Kubernetes see references
Red Hat Multicluster Engine for Kubernetes see references
Red Hat NVIDIA JetPack 6 for RHEL see references
Red Hat OpenShift Lightspeed see references
Red Hat OpenShift Lightspeed see references
Red Hat OpenShift Source-to-Image (S2I) see references
Red Hat OpenShift Source-to-Image (S2I) see references
Red Hat Red Hat Advanced Cluster Security 4 see references
Red Hat Red Hat Advanced Cluster Security 4 see references
Red Hat Red Hat Advanced Cluster Security 4 see references
Red Hat Red Hat Advanced Cluster Security 4 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Build of Podman Desktop see references
Red Hat Red Hat Certification Program for Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Developer Hub 1 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references

Weakness: CWE-772 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

References