CVE-2026-114236: 
Podman vulnerability analysis and mitigation

CVE-2026-114236 is a file descriptor leak vulnerability in the storage/pkg/archive Go package, specifically in the ApplyLayer and ApplyUncompressedLayer functions. When processing corrupt or malicious container image layer inputs, these functions may fail to release file descriptors; unbounded repeated calls can exhaust the process's file descriptor limit, resulting in a denial of service. The vulnerability was disclosed on October 21, 2026, and affects a broad range of Red Hat products including podman, buildah, skopeo, cri-o, containers-common, and numerous OpenShift 4 and RHEL-based container images. It carries a CVSS v3.1 base score of 3.3 (Low) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime): the ApplyLayer and ApplyUncompressedLayer functions in the storage/pkg/archive package do not properly close file descriptors when encountering malformed or malicious layer data, resulting in a goroutine and file descriptor leak (Red Hat CVE, Red Hat Bugzilla). The attack vector is local, requires no privileges, but does require user interaction (e.g., a user or process must trigger processing of a crafted container image layer). Exploitation requires the ability to supply corrupt or malicious container layer archives to an affected tool such as podman, buildah, or skopeo. No public proof-of-concept exploit code has been identified at the time of disclosure (GitHub Advisory).

Successful exploitation results in a limited denial of service: repeated processing of malicious or corrupt container image layers causes file descriptor exhaustion in the affected process, potentially preventing it from opening new files or network connections. There is no impact on confidentiality or integrity — the vulnerability is availability-only and scoped to the affected process without privilege escalation or lateral movement potential. The broad range of affected Red Hat products (podman, buildah, skopeo, cri-o, OpenShift components, Quay, and others) means the impact surface is wide in container-heavy environments (Red Hat CVE, Red Hat Bugzilla).

There is no known in-the-wild exploitation of CVE-2026-114236, and no public proof-of-concept exploit code has been identified. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the local attack vector and the requirement for user interaction, significantly limiting its practical exploitability.

Red Hat has acknowledged the vulnerability and patches are tracked via Bugzilla bug 2558105; affected products include podman, buildah, skopeo, cri-o, containers-common, and numerous OpenShift and RHEL container images (Red Hat CVE, Red Hat Bugzilla). Specific fixed version numbers have not yet been published at the time of disclosure. Organizations should monitor Red Hat's security advisories for updated packages and apply patches as they become available. As an interim measure, avoid processing untrusted or unverified container image layers with affected tools, and consider monitoring file descriptor usage on systems running podman, buildah, or skopeo in automated pipelines.