CVE-2024-3727highCWE-354

CVE-2024-3727: high-severity vulnerability in image

Containers/image: digest type does not guarantee valid type

Published · Updated

Follow this CVE+ Monitor Red Hat Enterprise Linux+ Monitor Red Hat OpenShift Container Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.3epss 1.3%
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
imageRed Hat · Multicluster Engine for KubernetesRed Hat · OADP-1.3-RHEL-9Red Hat · OpenShift Developer Tools and ServicesRed Hat · OpenShift ServerlessRed Hat · OpenShift Source-to-Image (S2I)Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2Red Hat · Red Hat Advanced Cluster Security 3Red Hat · Red Hat Advanced Cluster Security 4.4Red Hat · Red Hat Advanced Cluster Security 4.5Red Hat · Red Hat Ansible Automation Platform 1.2Red Hat · Red Hat Ansible Automation Platform 2Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Migration Toolkit for Containers 1.8Red Hat · Red Hat OpenShift Container Platform 3.11Red Hat · Red Hat OpenShift Container Platform 4Red Hat · Red Hat OpenShift Container Platform 4.13Red Hat · Red Hat OpenShift Container Platform 4.14Red Hat · Red Hat OpenShift Container Platform 4.15Red Hat · Red Hat OpenShift Container Platform 4.16Red Hat · Red Hat OpenShift Container Platform 4.17Red Hat · Red Hat OpenShift Container Platform 4.18Red Hat · Red Hat OpenShift Container Platform Assisted Installer 1Red Hat · Red Hat OpenShift Dev SpacesRed Hat · Red Hat Openshift Sandboxed ContainersRed Hat · Red Hat OpenShift Virtualization 4Red Hat · Red Hat OpenStack Platform 16.2Red Hat · Red Hat Quay 3Red Hat · RHEL-9-CNV-4.15
Related CVEs — image

In the same product, most dangerous first.

CVE-2026-16242CRITICALHypershift: konnectivity proxy-server accepts agent connections without validating client certificatesEPSS 0.9%CVE-2024-12401MEDIUMCert-manager: potential dos when parsing specially crafted pem inputsEPSS 0.7%CVE-2025-2241HIGHHive: exposure of vcenter credentials via clusterprovision in hive / mce / acmEPSS 0.5%CVE-2026-101919HIGHHypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control planeEPSS 0.4%CVE-2026-71299MEDIUMMaestro: maestro: rest api write endpoints registered without authentication middlewareEPSS 0.3%CVE-2026-71298MEDIUMMaestro: sql identifier injection via properties.* search filter and orderby fieldEPSS 0.3%