CVE-2026-19519 PUBLISHED

Claircore: claircore: denial of service via unchecked type assertion in rpm header parser

Assigner: redhat
Reserved: 11.08.2026 Published: 11.08.2026 Updated: 11.08.2026

A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 4.3

Product Status

Vendor Red Hat
Product Red Hat Advanced Cluster Security 4
Versions Default: affected
Vendor Red Hat
Product Red Hat Advanced Cluster Security 4
Versions Default: affected
Vendor Red Hat
Product Red Hat Quay 3
Versions Default: affected

Workarounds

Where possible, configure the indexer to run scanner workloads in isolated processes or containers so that a single scanner panic cannot terminate the shared indexer. Alternatively, deploy multiple indexer replicas behind a load balancer to reduce the blast radius of a single-process crash.

Credits

  • Red Hat would like to thank Arpit Jain (GitHub handle: arpitjain099) for reporting this issue.

References

Problem Types

  • Reachable Assertion CWE