CVE-2026-114236
Received Received - Intake

File descriptor leak in Go archive processing

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: redhat-SADP

Description
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-10-21
EPSS Evaluated
N/A
NVD
CVE-2026-114236
EUVD
EUVD-2026-107140

Affected Vendors & Products

Showing 84 associated CPEs
Vendor Product Version / Range
Red Hat Confidential Compute Attestation *
Red Hat DPU kit for NVIDIA *
Red Hat Exploit Intelligence *
Red Hat Multicluster Engine for Kubernetes *
Red Hat Multicluster Engine for Kubernetes *
Red Hat NVIDIA JetPack 6 for RHEL *
Red Hat OpenShift Lightspeed *
Red Hat OpenShift Source-to-Image (S2I) *
Red Hat OpenShift Source-to-Image (S2I) *
Red Hat Red Hat Advanced Cluster Security 4 *
Red Hat Red Hat Advanced Cluster Security 4 *
Red Hat Red Hat Advanced Cluster Security 4 *
Red Hat Red Hat Advanced Cluster Security 4 *
Red Hat Red Hat Ansible Automation Platform 2 *
Red Hat Red Hat Ansible Automation Platform 2 *
Red Hat Red Hat Ansible Automation Platform 2 *
Red Hat Red Hat Ansible Automation Platform 2 *
Red Hat Red Hat Ansible Automation Platform 2 *
Red Hat Red Hat Build of Podman Desktop *
Red Hat Red Hat Certification Program for Red Hat Enterprise Linux 9 *
Red Hat Red Hat Developer Hub *
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat Hardened Images *
Red Hat Red Hat Hardened Images *
Red Hat Red Hat Hardened Images *
Red Hat Red Hat Hardened Images *
Red Hat Red Hat Hardened Images *
Red Hat Red Hat OpenShift AI (RHOAI) *
Red Hat Red Hat OpenShift AI (RHOAI) *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Container Platform 4 *
Red Hat Red Hat OpenShift Dev Spaces *
Red Hat Red Hat OpenShift Dev Spaces *
Red Hat Red Hat OpenShift Dev Spaces *
Red Hat Red Hat OpenStack Platform 18.0 *
Red Hat Red Hat Quay 3 *
Red Hat Red Hat Quay 3 *
Red Hat Red Hat Quay 3 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-772 The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
AI Quick Actions have not been generated yet.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114236. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart