CVE-2026-19519: Claircore: claircore: denial of service via unchecked type assertion in rpm header parser
A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service.
Other sources
A flaw was found in claircore's RPM package scanner. The Info.Load function uses bare type assertions to cast values returned by ReadData into expected Go types. An attacker who can push an image containing a crafted RPM database can declare a tag with a type that passes the class-based checkTagType validation but returns a different Go concrete type from ReadData, causing an unrecoverable panic that crashes the Clair indexer process. The panic propagates through x/sync/errgroup and is not caught by Clair's catchAbort middleware, resulting in a denial of service affecting all users of the shared indexer. Additionally, zero-count array-typed tags cause index-out-of-range panics through the same unrecovered path.
— Red Hat