Go containers/storage FD leak in ApplyLayer/ApplyUncompressedLayer
CVE-2026-114236 Published on October 21, 2026

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process file descriptor limit

NVD

Vulnerability Analysis

CVE-2026-114236 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.

Exploitation:
NONE
Automatable:
NO
Technical Impact:
PARTIAL
Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
LOW

Timeline

Reported to Red Hat.

Made public.

Weakness Type

Missing Release of Resource after Effective Lifetime

The software does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed. When a resource is not released after use, it can allow attackers to cause a denial of service by causing the allocation of resources without triggering their release. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.


Products Associated with CVE-2026-114236

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Confidential Compute Attestation
Red Hat Dpu Kit
Red Hat Exploit Intelligence
Red Hat Multicluster Engine
Red Hat Jetpack
Red Hat Openshift Lightspeed
Red Hat Source To Image
Red Hat Advanced Cluster Security
Red Hat Ansible Automation Platform
Red Hat Podman Desktop
Red Hat Certifications
Red Hat Rhdh
Red Hat Enterprise Linux (RHEL)
Red Hat Hummingbird
Red Hat Openshift Ai
Red Hat Openshift
Red Hat Openshift Devspaces
Red Hat Openstack
Red Hat Quay

Affected Versions

Red Hat Confidential Compute Attestation: Red Hat DPU kit for NVIDIA: Red Hat Exploit Intelligence: Red Hat Multicluster Engine for Kubernetes: Red Hat Multicluster Engine for Kubernetes: Red Hat NVIDIA JetPack 6 for RHEL: Red Hat OpenShift Lightspeed: Red Hat OpenShift Lightspeed: Red Hat OpenShift Source-to-Image (S2I): Red Hat OpenShift Source-to-Image (S2I): Red Hat Advanced Cluster Security 4: Red Hat Advanced Cluster Security 4: Red Hat Advanced Cluster Security 4: Red Hat Advanced Cluster Security 4: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Build of Podman Desktop: Red Hat Certification Program for Red Hat Enterprise Linux 9: Red Hat Developer Hub 1: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Hardened Images: Red Hat Hardened Images: Red Hat Hardened Images: Red Hat Hardened Images: Red Hat Hardened Images: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Container Platform 5: Red Hat OpenShift Dev Spaces: Red Hat OpenShift Dev Spaces: Red Hat OpenShift Dev Spaces: Red Hat OpenStack Platform 18.0: Red Hat Quay 3: Red Hat Quay 3: Red Hat Quay 3: