CVE-2026-114236
Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
- Record
CVE-2026-114236- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-06
EUVDEUVD-2026-107140
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
- Record
EUVD-2026-107140- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-q5j6-vx79-v9f8
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or...
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
- Record
GHSA-q5j6-vx79-v9f8- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-02
NVD
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
- Record
CVE-2026-114236- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-772
- Updated
- 2026-11-06
OSVBELL-CVE-2026-114236
- Record
BELL-CVE-2026-114236- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVAZL-109826 No score
CVE-2026-114236 affecting package buildah 1.43.1-3
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
- Record
AZL-109826- Updated
- 2026-11-05
OSVAZL-109875 No score
CVE-2026-114236 affecting package podman 5.6.1-10
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
- Record
AZL-109875- Updated
- 2026-11-05
OSVAZL-109935 No score
CVE-2026-114236 affecting package containerized-data-importer 1.62.0-9
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
- Record
AZL-109935- Updated
- 2026-11-05
Affected products
- red hat confidential compute attestation
- red hat dpu kit for nvidia
- red hat exploit intelligence
- red hat multicluster engine for kubernetes
- red hat nvidia jetpack 6 for rhel
- red hat openshift lightspeed
- red hat openshift source-to-image (s2i)
- red hat advanced cluster security 4
- red hat ansible automation platform 2
- red hat build of podman desktop
- red hat certification program for red hat enterprise linux 9
- red hat developer hub 1
Affected packages
| Package | Affected | Fixed |
|---|---|---|
buildahAzure Linux:3 |
through 1.43.1-3 | None known |
podmanAzure Linux:3 |
through 5.6.1-10 | None known |
containerized-data-importerAzure Linux:3 |
through 1.62.0-9 | None known |
buildahAlpaquita:23 |
1.28.0-r1 and later | None known |
podmanAlpaquita:23 |
4.3.1-r0 and later | None known |
skopeoAlpaquita:23 |
1.10.0-r2 and later | None known |
buildahAlpaquita:25 |
1.40.0-r0 and later | None known |
podmanAlpaquita:25 |
5.5.0-r0 and later | None known |
skopeoAlpaquita:25 |
1.18.0-r2 and later | None known |
buildahAlpaquita:stream |
1.31.0-r0 and later | None known |
podmanAlpaquita:stream |
4.5.1-r1 and later | None known |
skopeoAlpaquita:stream |
1.13.0-r1 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-114236 is a low vulnerability (CVSS 3.3) in Red Hat Confidential Compute Attestation, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 1st percentile. No source names a fixed version.