{"id":"CVE-2026-114236","title":"Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers","summary":"storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor\nlimit","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-772"],"vendor":"Red Hat","product":"openshift-sandboxed-containers/osc-podvm-builder-rhel9","affected":["openshift-sandboxed-containers/osc-podvm-builder-rhel9 (all versions)","dpu-kit-for-nvidia/bluefield-ocp-layer-rhel10 (all versions)","exploit-intelligence/vulnerability-analysis-rhel9 (all versions)","multicluster-engine/assisted-service-9-rhel9 (all versions)","multicluster-engine/hive-rhel9 (all versions)","nvidia/nvidia-jetpack-for-rhel9 (all versions)","openshift-lightspeed/lightspeed-rhel9-operator (all versions)","source-to-image/source-to-image-rhel8 (all versions)","source-to-image/source-to-image-rhel9 (all versions)","advanced-cluster-security/rhacs-scanner-rhel8 (all versions)","advanced-cluster-security/rhacs-scanner-rhel9 (all versions)","advanced-cluster-security/rhacs-scanner-slim-rhel8 (all versions)","advanced-cluster-security/rhacs-scanner-slim-rhel9 (all versions)","ansible-automation-platform-26/hub-rhel9 (all versions)","ansible-automation-platform-27/ansible-devspaces-rhel9 (all versions)","ansible-automation-platform-27/ansible-dev-tools-rhel9 (all versions)","ansible-automation-platform-27/hub-rhel9 (all versions)","ansible-automation-platform-tech-preview/ansible-devspaces-rhel9 (all versions)","rh-podman-desktop (all versions)","redhat-certification-preflight (all versions)","rhdh/rhdh-hub-rhel9 (all versions)","buildah (all versions)","oci-seccomp-bpf-hook (all versions)","podman (all versions)","rhel10/bootc-image-builder (all versions)","rhel10-eus/rhel-10.2-bootc (all versions)","rhel10/rhel-bootc (all versions)","skopeo (all versions)","ubi10/buildah (all versions)","ubi10/skopeo (all versions)","buildah (all versions)","oci-seccomp-bpf-hook (all versions)","podman (all versions)","rhel9/bootc-image-builder (all versions)","rhel9-eus/rhel-9.8-bootc (all versions)","rhel9/rhel-bootc (all versions)","skopeo (all versions)","ubi9/buildah (all versions)","ubi9/skopeo (all versions)","buildah (all versions)","containers-common (all versions)","grype (all versions)","podman (all versions)","skopeo (all versions)","rhoai/odh-ml-pipelines-runtime-generic-rhel9 (all versions)","rhoai/odh-model-registry-job-async-upload-rhel9 (all versions)","cri-o (all versions)","openshift4/kube-compare-artifacts-rhel9 (all versions)","openshift4/microshift-bootc-rhel10 (all versions)","openshift4/microshift-bootc-rhel9 (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-28T16:22:12.507295Z"},"published":"2026-10-21","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:22:24.587Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114236","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-114236"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558105","label":"RHBZ#2558105"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114236.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114236"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00104,"epssPercentile":0.00997,"ingestedAt":"2026-10-21T08:45:36.242Z","slug":"CVE-2026-114236","body":"## Overview\n\nstorage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor\nlimit\n\n## Affected\n\n- `openshift-sandboxed-containers/osc-podvm-builder-rhel9 (all versions)`\n- `dpu-kit-for-nvidia/bluefield-ocp-layer-rhel10 (all versions)`\n- `exploit-intelligence/vulnerability-analysis-rhel9 (all versions)`\n- `multicluster-engine/assisted-service-9-rhel9 (all versions)`\n- `multicluster-engine/hive-rhel9 (all versions)`\n- `nvidia/nvidia-jetpack-for-rhel9 (all versions)`\n- `openshift-lightspeed/lightspeed-rhel9-operator (all versions)`\n- `source-to-image/source-to-image-rhel8 (all versions)`\n- `source-to-image/source-to-image-rhel9 (all versions)`\n- `advanced-cluster-security/rhacs-scanner-rhel8 (all versions)`\n- `advanced-cluster-security/rhacs-scanner-rhel9 (all versions)`\n- `advanced-cluster-security/rhacs-scanner-slim-rhel8 (all versions)`\n- `advanced-cluster-security/rhacs-scanner-slim-rhel9 (all versions)`\n- `ansible-automation-platform-26/hub-rhel9 (all versions)`\n- `ansible-automation-platform-27/ansible-devspaces-rhel9 (all versions)`\n- `ansible-automation-platform-27/ansible-dev-tools-rhel9 (all versions)`\n- `ansible-automation-platform-27/hub-rhel9 (all versions)`\n- `ansible-automation-platform-tech-preview/ansible-devspaces-rhel9 (all versions)`\n- `rh-podman-desktop (all versions)`\n- `redhat-certification-preflight (all versions)`\n- `rhdh/rhdh-hub-rhel9 (all versions)`\n- `buildah (all versions)`\n- `oci-seccomp-bpf-hook (all versions)`\n- `podman (all versions)`\n- `rhel10/bootc-image-builder (all versions)`\n- `rhel10-eus/rhel-10.2-bootc (all versions)`\n- `rhel10/rhel-bootc (all versions)`\n- `skopeo (all versions)`\n- `ubi10/buildah (all versions)`\n- `ubi10/skopeo (all versions)`\n- `buildah (all versions)`\n- `oci-seccomp-bpf-hook (all versions)`\n- `podman (all versions)`\n- `rhel9/bootc-image-builder (all versions)`\n- `rhel9-eus/rhel-9.8-bootc (all versions)`\n- `rhel9/rhel-bootc (all versions)`\n- `skopeo (all versions)`\n- `ubi9/buildah (all versions)`\n- `ubi9/skopeo (all versions)`\n- `buildah (all versions)`\n- `containers-common (all versions)`\n- `grype (all versions)`\n- `podman (all versions)`\n- `skopeo (all versions)`\n- `rhoai/odh-ml-pipelines-runtime-generic-rhel9 (all versions)`\n- `rhoai/odh-model-registry-job-async-upload-rhel9 (all versions)`\n- `cri-o (all versions)`\n- `openshift4/kube-compare-artifacts-rhel9 (all versions)`\n- `openshift4/microshift-bootc-rhel10 (all versions)`\n- `openshift4/microshift-bootc-rhel9 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Confidential Compute Attestation, DPU kit for NVIDIA, Exploit Intelligence, Multicluster Engine for Kubernetes, NVIDIA JetPack 6 for RHEL, OpenShift Lightspeed, … · no fix planned: Confidential Compute Attestation, DPU kit for NVIDIA, Exploit Intelligence, Multicluster Engine for Kubernetes, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114236.json)","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}