CRI-O Container Runtime Environment Variable Handling Flaw Leads to DoS

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: redhat-SADP

Description

A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-24

Generated

2026-08-25

AI Q&A

2026-08-25

EPSS Evaluated

N/A

NVD

CVE-2026-17113

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	cri-o	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1287	The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in CRI-O's handling of environment variables during container creation. When a container creation request provides a null environment variable field, CRI-O incorrectly uses the image's environment variables without proper validation. If an image contains an environment variable without an equals sign (e.g., NOEQUALS), it causes a runtime panic in the CRI-O daemon, crashing the container-runtime service for all workloads on the node until manually restarted.

Impact Analysis

This vulnerability can cause unexpected crashes of the CRI-O daemon, leading to downtime for all containers on the affected node. It requires no user interaction beyond a malicious or misconfigured container image being deployed, potentially disrupting services relying on that node.

Mitigation Strategies

Update CRI-O to the latest patched version to fix the container-creation environment-variable handling flaw. Restart the crio daemon after applying the update to ensure the fix is active.

Hi! I’m here to help you understand CVE-2026-17113. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70