Low severity · published Oct 21, 2026
CVE-2026-114236
Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
3.3
CVSS
0.1%
EPSS
No
On KEV
Description
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor
limit
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Confidential Compute Attestation · Red Hat
All versions, or not specified · source: vendor
DK
DPU kit for NVIDIA · Red Hat
All versions, or not specified · source: vendor
EI
Exploit Intelligence · Red Hat
All versions, or not specified · source: vendor
ME
Multicluster Engine for Kubernetes · Red Hat
All versions, or not specified · source: vendor
NJ
NVIDIA JetPack 6 for RHEL · Red Hat
All versions, or not specified · source: vendor
OL
OpenShift Lightspeed · Red Hat
All versions, or not specified · source: vendor
OS
OpenShift Source-to-Image (S2I) · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Advanced Cluster Security 4 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Ansible Automation Platform 2 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Build of Podman Desktop · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Certification Program for Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Developer Hub 1 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114236
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114236
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-114236
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2558105
More from Confidential Compute Attestation
10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
9.8
CVE-2026-4800
lodash vulnerable to Code Injection via `_.template` imports key names
9.1
CVE-2026-39830
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
8.2
CVE-2026-41326
Kata Containers: CopyFile Policy Subversion via Symlinks
7.8
CVE-2026-15809
Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env