Claircore RPM Scanner DoS via Crafted RPM Header Crash
CVE-2026-19519 Published on August 11, 2026

Claircore: claircore: denial of service via unchecked type assertion in rpm header parser
A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service.

NVD

Vulnerability Analysis

CVE-2026-19519 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
LOW

Timeline

Reported to Red Hat.

Made public.

Weakness Type

What is an assertion failure Vulnerability?

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

CVE-2026-19519 has been classified to as an assertion failure vulnerability or weakness.


Products Associated with CVE-2026-19519

stack.watch emails you whenever new vulnerabilities are published in Red Hat Advanced Cluster Security or Red Hat Quay. Just hit a watch button to start following.

Red Hat Advanced Cluster Security
 
Red Hat Quay
 

Affected Versions

Red Hat Advanced Cluster Security 4: Red Hat Advanced Cluster Security 4: Red Hat Advanced Cluster Security 4: Red Hat Advanced Cluster Security 4: Red Hat Advanced Cluster Security 4: Red Hat Advanced Cluster Security 4: Red Hat Advanced Cluster Security 4: Red Hat Advanced Cluster Security 4: Red Hat Advanced Cluster Security 4: Red Hat Quay 3: Red Hat Quay 3: