---
id: CVE-2026-114236
title: >-
  podman: Goroutine/file-descriptor leak in storage/pkg/archive.ApplyLayer and
  ApplyUncompressedLayer on malformed layers (CVE-2026-114236)
summary: >-
  storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing
  corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls
  can exhaust the process’ file descriptor

  limit
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'
cvssSource: vendor
cwe: CWE-772
vendor: Red Hat
product: Red Hat OpenShift Container Platform 4
affected:
  - confidential_compute_attestation
  - dpu_kit_for_nvidia
  - exploit_intelligence
  - multicluster_engine_for_kubernetes
  - nvidia_jetpack_6_for_rhel
  - openshift_lightspeed
  - openshift_source_to_image_s2i
  - advanced_cluster_security 4
  - ansible_automation_platform 2
  - build_of_podman_desktop
  - certification_program_for_red_hat_enterprise_linux 9
  - developer_hub
  - enterprise_linux 10
  - enterprise_linux 9
  - hardened_images
  - openshift_ai_rhoai
  - openshift_container_platform 4
  - openshift_dev_spaces
  - openstack_platform 18.0
  - quay 3
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T09:34:49+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114236.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114236.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-114236'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2558105'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-114236'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114236'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
ingestedAt: '2026-10-21T08:45:36.242Z'
---

## Overview

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor
limit

## Vendor advisories

- **Red Hat VEX** · Low · affected: Confidential Compute Attestation, DPU kit for NVIDIA, Exploit Intelligence, Multicluster Engine for Kubernetes, NVIDIA JetPack 6 for RHEL, OpenShift Lightspeed, … · no fix planned: Confidential Compute Attestation, DPU kit for NVIDIA, Exploit Intelligence, Multicluster Engine for Kubernetes, … · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114236.json)

**podman: Goroutine/file-descriptor leak in storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer on malformed layers** — rated Low by Red Hat. Released 2026-10-21.

Affected:

- Confidential Compute Attestation
- DPU kit for NVIDIA
- Exploit Intelligence
- Multicluster Engine for Kubernetes
- NVIDIA JetPack 6 for RHEL
- OpenShift Lightspeed
- OpenShift Source-to-Image (S2I)
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Podman Desktop
- Red Hat Certification Program for Red Hat Enterprise Linux 9
- Red Hat Developer Hub
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenStack Platform 18.0
- Red Hat Quay 3

No fix planned:

- Confidential Compute Attestation
- DPU kit for NVIDIA
- Exploit Intelligence
- Multicluster Engine for Kubernetes
- NVIDIA JetPack 6 for RHEL
- OpenShift Lightspeed
- OpenShift Source-to-Image (S2I)
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Podman Desktop
- Red Hat Certification Program for Red Hat Enterprise Linux 9
- Red Hat Developer Hub
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenStack Platform 18.0
- Red Hat Quay 3

## Remediation

Fix deferred