{"id":"CVE-2026-114236","title":"podman: Goroutine/file-descriptor leak in storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer on malformed layers (CVE-2026-114236)","summary":"storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor\nlimit","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cvssSource":"vendor","cwe":"CWE-772","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","affected":["confidential_compute_attestation","dpu_kit_for_nvidia","exploit_intelligence","multicluster_engine_for_kubernetes","nvidia_jetpack_6_for_rhel","openshift_lightspeed","openshift_source_to_image_s2i","advanced_cluster_security 4","ansible_automation_platform 2","build_of_podman_desktop","certification_program_for_red_hat_enterprise_linux 9","developer_hub","enterprise_linux 10","enterprise_linux 9","hardened_images","openshift_ai_rhoai","openshift_container_platform 4","openshift_dev_spaces","openstack_platform 18.0","quay 3"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T09:34:49+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114236.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114236.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-114236"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558105"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114236"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-21T08:45:36.242Z","slug":"CVE-2026-114236","body":"## Overview\n\nstorage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor\nlimit\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Confidential Compute Attestation, DPU kit for NVIDIA, Exploit Intelligence, Multicluster Engine for Kubernetes, NVIDIA JetPack 6 for RHEL, OpenShift Lightspeed, … · no fix planned: Confidential Compute Attestation, DPU kit for NVIDIA, Exploit Intelligence, Multicluster Engine for Kubernetes, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114236.json)\n\n**podman: Goroutine/file-descriptor leak in storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer on malformed layers** — rated Low by Red Hat. Released 2026-10-21.\n\nAffected:\n\n- Confidential Compute Attestation\n- DPU kit for NVIDIA\n- Exploit Intelligence\n- Multicluster Engine for Kubernetes\n- NVIDIA JetPack 6 for RHEL\n- OpenShift Lightspeed\n- OpenShift Source-to-Image (S2I)\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ansible Automation Platform 2\n- Red Hat Build of Podman Desktop\n- Red Hat Certification Program for Red Hat Enterprise Linux 9\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat Hardened Images\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenStack Platform 18.0\n- Red Hat Quay 3\n\nNo fix planned:\n\n- Confidential Compute Attestation\n- DPU kit for NVIDIA\n- Exploit Intelligence\n- Multicluster Engine for Kubernetes\n- NVIDIA JetPack 6 for RHEL\n- OpenShift Lightspeed\n- OpenShift Source-to-Image (S2I)\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ansible Automation Platform 2\n- Red Hat Build of Podman Desktop\n- Red Hat Certification Program for Red Hat Enterprise Linux 9\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat Hardened Images\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenStack Platform 18.0\n- Red Hat Quay 3\n\n## Remediation\n\nFix deferred","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}