CVE-2026-114236 PUBLISHED

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

Assigner: redhat
Reserved: 21.10.2026 Published: 21.10.2026 Updated: 21.10.2026

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS Score: 3.3

Product Status

Vendor Red Hat
Product Confidential Compute Attestation
Versions Default: affected
Vendor Red Hat
Product DPU kit for NVIDIA
Versions Default: affected
Vendor Red Hat
Product Exploit Intelligence
Versions Default: affected
Vendor Red Hat
Product Multicluster Engine for Kubernetes
Versions Default: affected
Vendor Red Hat
Product Multicluster Engine for Kubernetes
Versions Default: affected
Vendor Red Hat
Product NVIDIA JetPack 6 for RHEL
Versions Default: affected
Vendor Red Hat
Product OpenShift Lightspeed
Versions Default: affected
Vendor Red Hat
Product OpenShift Source-to-Image (S2I)
Versions Default: affected
Vendor Red Hat
Product OpenShift Source-to-Image (S2I)
Versions Default: affected
Vendor Red Hat
Product Red Hat Advanced Cluster Security 4
Versions Default: affected
Vendor Red Hat
Product Red Hat Advanced Cluster Security 4
Versions Default: affected
Vendor Red Hat
Product Red Hat Advanced Cluster Security 4
Versions Default: affected
Vendor Red Hat
Product Red Hat Advanced Cluster Security 4
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Build of Podman Desktop
Versions Default: affected
Vendor Red Hat
Product Red Hat Certification Program for Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Developer Hub
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Hardened Images
Versions Default: affected
Vendor Red Hat
Product Red Hat Hardened Images
Versions Default: affected
Vendor Red Hat
Product Red Hat Hardened Images
Versions Default: affected
Vendor Red Hat
Product Red Hat Hardened Images
Versions Default: affected
Vendor Red Hat
Product Red Hat Hardened Images
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift AI (RHOAI)
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift AI (RHOAI)
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Dev Spaces
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Dev Spaces
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Dev Spaces
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenStack Platform 18.0
Versions Default: affected
Vendor Red Hat
Product Red Hat Quay 3
Versions Default: affected
Vendor Red Hat
Product Red Hat Quay 3
Versions Default: affected
Vendor Red Hat
Product Red Hat Quay 3
Versions Default: affected

References

Problem Types

  • Missing Release of Resource after Effective Lifetime CWE