CVE-2026-114236

Awaiting Analysis Awaiting Analysis - Queue

File descriptor leak in Go archive processing

Publication date: 2026-10-21

Last updated on: 2026-11-06

Assigner: redhat-SADP

Description

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-11-06

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114236

EUVD

EUVD-2026-107140

Affected Vendors & Products

Vendor	Product	Version / Range
Red Hat	Confidential Compute Attestation	*
Red Hat	DPU kit for NVIDIA	*
Red Hat	Exploit Intelligence	*
Red Hat	Multicluster Engine for Kubernetes	*
Red Hat	Multicluster Engine for Kubernetes	*
Red Hat	NVIDIA JetPack 6 for RHEL	*
Red Hat	OpenShift Lightspeed	*
Red Hat	OpenShift Source-to-Image (S2I)	*
Red Hat	OpenShift Source-to-Image (S2I)	*
Red Hat	Red Hat Advanced Cluster Security 4	*
Red Hat	Red Hat Advanced Cluster Security 4	*
Red Hat	Red Hat Advanced Cluster Security 4	*
Red Hat	Red Hat Advanced Cluster Security 4	*
Red Hat	Red Hat Ansible Automation Platform 2	*
Red Hat	Red Hat Ansible Automation Platform 2	*
Red Hat	Red Hat Ansible Automation Platform 2	*
Red Hat	Red Hat Ansible Automation Platform 2	*
Red Hat	Red Hat Ansible Automation Platform 2	*
Red Hat	Red Hat Build of Podman Desktop	*
Red Hat	Red Hat Certification Program for Red Hat Enterprise Linux 9	*
Red Hat	Red Hat Developer Hub	*
Red Hat	Red Hat Enterprise Linux 10	*
Red Hat	Red Hat Enterprise Linux 10	*
Red Hat	Red Hat Enterprise Linux 10	*
Red Hat	Red Hat Enterprise Linux 10	*
Red Hat	Red Hat Enterprise Linux 10	*
Red Hat	Red Hat Enterprise Linux 10	*
Red Hat	Red Hat Enterprise Linux 10	*
Red Hat	Red Hat Enterprise Linux 10	*
Red Hat	Red Hat Enterprise Linux 10	*
Red Hat	Red Hat Enterprise Linux 9	*
Red Hat	Red Hat Enterprise Linux 9	*
Red Hat	Red Hat Enterprise Linux 9	*
Red Hat	Red Hat Enterprise Linux 9	*
Red Hat	Red Hat Enterprise Linux 9	*
Red Hat	Red Hat Enterprise Linux 9	*
Red Hat	Red Hat Enterprise Linux 9	*
Red Hat	Red Hat Enterprise Linux 9	*
Red Hat	Red Hat Enterprise Linux 9	*
Red Hat	Red Hat Hardened Images	*
Red Hat	Red Hat Hardened Images	*
Red Hat	Red Hat Hardened Images	*
Red Hat	Red Hat Hardened Images	*
Red Hat	Red Hat Hardened Images	*
Red Hat	Red Hat OpenShift AI (RHOAI)	*
Red Hat	Red Hat OpenShift AI (RHOAI)	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Container Platform 4	*
Red Hat	Red Hat OpenShift Dev Spaces	*
Red Hat	Red Hat OpenShift Dev Spaces	*
Red Hat	Red Hat OpenShift Dev Spaces	*
Red Hat	Red Hat OpenStack Platform 18.0	*
Red Hat	Red Hat Quay 3	*
Red Hat	Red Hat Quay 3	*
Red Hat	Red Hat Quay 3	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-772	The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

Executive Summary

This vulnerability involves a file descriptor leak in Podman's storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer functions. When processing corrupt or malicious input layers, these functions fail to release file descriptors properly. Repeated calls with such inputs can exhaust the process's file descriptor limit, leading to potential denial-of-service conditions.

Detection Guidance

Monitor file descriptor usage with commands like 'lsof -p <PID>' or 'ls /proc/<PID>/fd | wc -l' to detect leaks. Check for repeated crashes or hangs in Podman processes handling archive operations.

Impact Analysis

The main impact is file descriptor exhaustion, which can cause processes to crash or become unresponsive due to hitting system limits. This may disrupt services relying on Podman, especially in containerized environments. The attack requires local access and repeated exploitation, making it less likely for remote attackers to exploit.

Compliance Impact

This vulnerability primarily causes file descriptor exhaustion leading to denial-of-service conditions. It does not directly impact data confidentiality or integrity required by GDPR or HIPAA. However, prolonged DoS conditions could disrupt regulated services, potentially affecting compliance with availability requirements in these standards.

Mitigation Strategies

Upgrade Podman to a patched version. Avoid processing untrusted container images. Restrict access to Podman commands for unprivileged users. Monitor system file descriptor limits and adjust if necessary.

Hi! I’m here to help you understand CVE-2026-114236. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...