What’s Vulnerable › Vulnerabilities

CVE-2026-114236: Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-30
• Weakness: CWE-772

Description

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit

Affected products

• Red Hat Advanced Cluster Management for Kubernetes 2: all versions
• Red Hat Confidential Compute Attestation: all versions
• Red Hat DPU kit for NVIDIA: all versions
• Red Hat Exploit Intelligence: all versions
• Red Hat NVIDIA JetPack 6 for RHEL: all versions
• Red Hat OpenShift Container Platform 4.18: all versions
• Red Hat OpenShift Lightspeed: all versions
• Red Hat OpenShift Source-to-Image (S2I): all versions
• Red Hat Quay 3: all versions
• Red Hat Advanced Cluster Security 4: all versions
• Red Hat Ansible Automation Platform 2: all versions
• Red Hat Build of Podman Desktop: all versions
• Red Hat Certification Program for Red Hat Enterprise Linux 9: all versions
• Red Hat Developer Hub 1: all versions
• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 9: all versions
• Red Hat Hardened Images: all versions
• Red Hat OpenShift AI (RHOAI): all versions
• Red Hat OpenShift Container Platform 5: all versions
• Red Hat OpenShift Dev Spaces: all versions
• Red Hat OpenStack Platform 18.0: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-114236
• https://bugzilla.redhat.com/show_bug.cgi?id=2558105

Get alerted when CVE-2026-114236 or the next vulnerability affects your stack