REDHAT-BUG-2558105: Low severity Moby Moby vulnerability
Published Oct 21, 2026
·Updated
Goroutine/file-descriptor leak in storage/pkg/archiveApplyLayer/ApplyUncompressedLayer on malformed layers
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit.
Affected Software
1 affected component
Moby Moby
Event History
Oct 21, 2026
Data Sourced
via Red Hat·06:43 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What would an attacker need to do to trigger the issue?
They would need to cause storage/pkg/archive.ApplyLayer or ApplyUncompressedLayer to process corrupt or malicious layer input. Repeated triggering is required to build up enough leaked file descriptors to exhaust the process limit.
2
What is the practical impact of successful exploitation?
Repeated malformed-layer processing can leak file descriptors until the affected process reaches its file descriptor limit. This can cause a denial-of-service condition for that process.