CVE-2026-114236
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
- Score
- CVSS 3.1 3.3 Low
- Status
- Awaiting Analysis - secalert@redhat.com
- Published
- 2026-10-21
- Last modified
- 2026-10-28
- Weaknesses
- CWE-772
Affected products
- Advanced Cluster Security (Redhat)
- Ansible Automation Platform (Redhat)
- Certifications (Redhat)
- Confidential Compute Attestation (Redhat)
- Dpu Kit (Redhat)
- Enterprise Linux (Redhat)
- Exploit Intelligence (Redhat)
- Hummingbird (Redhat)
- Jetpack (Redhat)
- Multicluster Engine (Redhat)
- Openshift (Redhat)
- Openshift Ai (Redhat)
- Openshift Devspaces (Redhat)
- Openshift Lightspeed (Redhat)
- Openstack (Redhat)
- Podman Desktop (Redhat)
- Quay (Redhat)
- Rhdh (Redhat)
- Source To Image (Redhat)
References
- https://access.redhat.com/security/cve/CVE-2026-114236
- https://bugzilla.redhat.com/show_bug.cgi?id=2558105
