PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-114236 Red Hat CVE debrief

A low-severity vulnerability was found in Podman's storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer functions, which may leak a file descriptor when processing corrupt or malicious inputs. Unbounded repeated calls can exhaust the process' file descriptor limit. This issue affects Podman deployments processing untrusted layer inputs. Defenders should assess exposure, prioritize patching, and monitor for potential resource exhaustion. The CVE Program record and NVD detail page provide official vulnerability metadata.

Vendor
Red Hat
Product
Confidential Compute Attestation
CVSS
LOW 3.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-30
Advisory published
2026-10-21
Advisory updated
2026-10-30

Who should care

Defenders of systems using Podman, especially those processing untrusted inputs or with resource-constrained environments, should assess exposure and prioritize patching.

Why it matters

CVE-2026-114236 is a low-severity vulnerability in Podman that may lead to file descriptor leaks and exhaustion under certain conditions. Defenders should verify and patch affected systems, especially those handling untrusted inputs.

  • Potential file descriptor exhaustion due to unbounded leaks
  • Resource constraints may lead to denial of service
  • Verification of patching and system configuration is necessary
  • Monitoring for unusual resource usage patterns is advised

Technical summary

The ApplyLayer and ApplyUncompressedLayer functions in Podman's storage/pkg/archive module may leak a file descriptor when processing corrupt or malicious layer inputs. Repeated calls can lead to file descriptor limit exhaustion. This vulnerability impacts Podman systems handling untrusted inputs. Defenders should verify and patch affected systems, especially those with untrusted input processing, to prevent potential resource exhaustion.

Defensive priority

Defenders should prioritize verifying and patching affected systems, especially those with untrusted input processing, to prevent potential resource exhaustion.

Recommended defensive actions

  • Verify affected systems and apply patches
  • Assess exposure for systems processing untrusted input
  • Monitor for potential resource exhaustion

Evidence notes

The CVE Program record and NVD detail page provide official vulnerability metadata. Red Hat has provided supplemental information on affected products.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-114236 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-114236

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-114236 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-114236

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.