{"id":"CVE-2026-114236","aliases":[],"title":"Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers","titleSource":"redhat","descriptionSource":"redhat","products":[{"vendor":"Red Hat","name":"Confidential Compute Attestation","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"DPU kit for NVIDIA","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Exploit Intelligence","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Multicluster Engine for Kubernetes","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Multicluster Engine for Kubernetes","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"NVIDIA JetPack 6 for RHEL","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"OpenShift Lightspeed","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"OpenShift Source-to-Image (S2I)","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"OpenShift Source-to-Image (S2I)","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Advanced Cluster Security 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Advanced Cluster Security 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Advanced Cluster Security 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Advanced Cluster Security 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Ansible Automation Platform 2","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Ansible Automation Platform 2","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Ansible Automation Platform 2","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Ansible Automation Platform 2","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Ansible Automation Platform 2","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Build of Podman Desktop","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Certification Program for Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Developer Hub 1","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 10","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Enterprise Linux 9","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Hardened Images","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Hardened Images","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Hardened Images","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Hardened Images","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Hardened Images","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift AI (RHOAI)","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift AI (RHOAI)","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Dev Spaces","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Dev Spaces","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenShift Dev Spaces","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat OpenStack Platform 18.0","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Quay 3","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Quay 3","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"},{"vendor":"Red Hat","name":"Red Hat Quay 3","platforms":[],"versions":[],"defaultStatus":"affected","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"}],"remediation":[],"description":"storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor\nlimit","severity":"low","score":3.3,"published":"2026-10-21T08:04:32.529Z","modified":"2026-10-28T16:22:24.587Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://access.redhat.com/security/cve/CVE-2026-114236","https://bugzilla.redhat.com/show_bug.cgi?id=2558105"],"sources":[{"name":"CVE","id":"CVE-2026-114236","modified":"2026-10-28T16:22:24.587Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-114236"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","score":3.3}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T19:55:31.817Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T16:40:34.897Z","attemptedAt":"2026-10-28T16:40:34.897Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T16:40:34.606Z","attemptedAt":"2026-10-28T16:40:34.606Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T16:40:33.707Z","attemptedAt":"2026-10-28T16:40:33.707Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-28T16:40:34.474Z","attemptedAt":"2026-10-28T16:40:34.474Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-107140","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107140","modified":"Oct 27, 2026, 5:43:10 AM","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","checkedAt":"2026-10-28T16:40:33.707Z"},{"source":"FIRST EPSS","id":"CVE-2026-114236","url":"https://www.first.org/epss/","probability":0.00104,"percentile":0.00997,"date":"2026-10-28","checkedAt":"2026-10-28T16:40:34.474Z"},{"source":"GitHub Advisory Database","id":"GHSA-q5j6-vx79-v9f8","url":"https://github.com/advisories/GHSA-q5j6-vx79-v9f8","modified":"2026-10-21T09:30:35Z","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","checkedAt":"2026-10-28T16:40:34.606Z"},{"source":"NVD","id":"CVE-2026-114236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114236","modified":"2026-10-27T06:17:23.663","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","checkedAt":"2026-10-28T16:40:34.897Z"}]}