CVE-2026-114236: low-severity vulnerability in Red Hat Confidential Compute Attestation
Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.3epss 0.1%
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor
limit
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected products
Red Hat · Confidential Compute AttestationRed Hat · DPU kit for NVIDIARed Hat · Exploit IntelligenceRed Hat · Multicluster Engine for KubernetesRed Hat · NVIDIA JetPack 6 for RHELRed Hat · OpenShift LightspeedRed Hat · OpenShift Source-to-Image (S2I)Red Hat · Red Hat Advanced Cluster Security 4Red Hat · Red Hat Ansible Automation Platform 2Red Hat · Red Hat Build of Podman DesktopRed Hat · Red Hat Certification Program for Red Hat Enterprise Linux 9Red Hat · Red Hat Developer Hub 1Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Hardened ImagesRed Hat · Red Hat OpenShift AI (RHOAI)Red Hat · Red Hat OpenShift Container Platform 4Red Hat · Red Hat OpenShift Container Platform 5Red Hat · Red Hat OpenShift Dev SpacesRed Hat · Red Hat OpenStack Platform 18.0Red Hat · Red Hat Quay 3Related CVEs — Red Hat Confidential Compute Attestation
In the same product, most dangerous first.
CVE-2026-87742HIGHQuarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message bufferingEPSS 0.8%CVE-2026-92574HIGHCri-o: cri-o checkpoint restore bypasses destination security contextEPSS 0.7%CVE-2026-94449HIGHQuarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of serviceEPSS 0.6%CVE-2026-81829MEDIUMSmallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolverEPSS 0.6%CVE-2026-93432MEDIUMIo.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkusEPSS 0.5%CVE-2026-87743HIGHQuarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http securityEPSS 0.5%