CVE-2026-114236: Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
Published Oct 21, 2026
·Updated
Goroutine/file-descriptor leak in storage/pkg/archiveApplyLayer/ApplyUncompressedLayer on malformed layers
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit.
Affected Software
1 affected component
Red Hat Podman
Event History
Oct 21, 2026
Data Sourced
via Red Hat·06:43 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·08:04 AM
Data Sourced
via MITRE·08:04 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require authenticated access or user interaction?
The CVSS vector indicates the attack is local and requires user interaction, but does not require prior privileges.
2
What is the expected security impact beyond resource exhaustion?
The CVSS assessment indicates no confidentiality or integrity impact. Availability impact is rated low, consistent with file-descriptor exhaustion affecting the process after repeated triggering.