Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

Summary

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit

Timeline

1. Oct 21, 2026, 8:04 AM UTCCVE published
2. Oct 22, 2026, 5:23 AM UTCFirst seen by cve.now
3. Oct 28, 2026, 4:22 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

4. Oct 30, 2026, 8:22 AM UTCRecord last updated

Affected versions

• openshift-sandboxed-containers/osc-podvm-builder-rhel9

  Version range not reported

• dpu-kit-for-nvidia/bluefield-ocp-layer-rhel10

  Version range not reported

• exploit-intelligence/vulnerability-analysis-rhel9

  Version range not reported

• multicluster-engine/assisted-service-9-rhel9

  Version range not reported

• multicluster-engine/hive-rhel9

  Version range not reported

• nvidia/nvidia-jetpack-for-rhel9

  Version range not reported

• openshift-lightspeed/lightspeed-rhel9-operator

  Version range not reported

• source-to-image/source-to-image-rhel8

  Version range not reported

• source-to-image/source-to-image-rhel9

  Version range not reported

• advanced-cluster-security/rhacs-scanner-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-rhel9

  Version range not reported

• advanced-cluster-security/rhacs-scanner-slim-rhel8

  Version range not reported

• advanced-cluster-security/rhacs-scanner-slim-rhel9

  Version range not reported

• ansible-automation-platform-26/hub-rhel9

  Version range not reported

• ansible-automation-platform-27/ansible-devspaces-rhel9

  Version range not reported

• ansible-automation-platform-27/ansible-dev-tools-rhel9

  Version range not reported

• ansible-automation-platform-27/hub-rhel9

  Version range not reported

• ansible-automation-platform-tech-preview/ansible-devspaces-rhel9

  Version range not reported

• rh-podman-desktop

  Version range not reported

• redhat-certification-preflight

  Version range not reported

• rhdh/rhdh-hub-rhel9

  Version range not reported

• buildah

  Version range not reported

• oci-seccomp-bpf-hook

  Version range not reported

• podman

  Version range not reported

• rhel10/bootc-image-builder

  Version range not reported

• rhel10-eus/rhel-10.2-bootc

  Version range not reported

• rhel10/rhel-bootc

  Version range not reported

• skopeo

  Version range not reported

• ubi10/buildah

  Version range not reported

• ubi10/skopeo

  Version range not reported

• buildah

  Version range not reported

• oci-seccomp-bpf-hook

  Version range not reported

• podman

  Version range not reported

• rhel9/bootc-image-builder

  Version range not reported

• rhel9-eus/rhel-9.8-bootc

  Version range not reported

• rhel9/rhel-bootc

  Version range not reported

• skopeo

  Version range not reported

• ubi9/buildah

  Version range not reported

• ubi9/skopeo

  Version range not reported

• buildah

  Version range not reported

• containers-common

  Version range not reported

• grype

  Version range not reported

• podman

  Version range not reported

• skopeo

  Version range not reported

• rhoai/odh-ml-pipelines-runtime-generic-rhel9

  Version range not reported

• rhoai/odh-model-registry-job-async-upload-rhel9

  Version range not reported

• cri-o

  Version range not reported

• openshift4/kube-compare-artifacts-rhel9

  Version range not reported

• openshift4/microshift-bootc-rhel10

  Version range not reported

• openshift4/microshift-bootc-rhel9

  Version range not reported

• openshift4/network-tools-rhel9

  Version range not reported

• openshift4/oc-mirror-plugin-rhel9

  Version range not reported

• openshift4/ose-agent-installer-api-server-rhel9

  Version range not reported

• openshift4/ose-agent-installer-csr-approver-rhel9

  Version range not reported

• openshift4/ose-baremetal-installer-rhel9

  Version range not reported

• openshift4/ose-cli-artifacts-rhel9

  Version range not reported

• openshift4/ose-cli-rhel9

  Version range not reported

• openshift4/ose-console-rhel9

  Version range not reported

• openshift4/ose-deployer-rhel9

  Version range not reported

• openshift4/ose-helm-rhel9-operator

  Version range not reported

• openshift4/ose-installer-artifacts-rhel9

  Version range not reported

• openshift4/ose-installer-rhel9

  Version range not reported

• openshift4/ose-local-storage-mustgather-rhel9

  Version range not reported

• openshift4/ose-machine-config-rhel9-operator

  Version range not reported

• openshift4/ose-machine-os-images-rhel9

  Version range not reported

• openshift4/ose-must-gather-rhel9

  Version range not reported

• openshift4/ose-olm-catalogd-rhel9

  Version range not reported

• openshift4/ose-olm-operator-controller-rhel9

  Version range not reported

• openshift4/ose-operator-framework-tools-rhel9

  Version range not reported

• openshift4/ose-operator-lifecycle-manager-rhel9

  Version range not reported

• openshift4/ose-operator-registry-rhel9

  Version range not reported

• openshift4/ose-ovn-kubernetes-rhel9

  Version range not reported

• openshift4/ose-secrets-store-csi-mustgather-rhel9

  Version range not reported

• openshift4/ose-tests-rhel9

  Version range not reported

• openshift4/ose-tools-rhel9

  Version range not reported

• openshift4/ptp-must-gather-rhel9

  Version range not reported

• ose-crio-credential-provider

  Version range not reported

• cri-o

  Version range not reported

• openshift5/kube-compare-artifacts-rhel9

  Version range not reported

• openshift5/lifecycle-agent-operator-bundle

  Version range not reported

• openshift5/lifecycle-agent-rhel9-operator

  Version range not reported

• openshift5/microshift-bootc-rhel10

  Version range not reported

• openshift5/microshift-bootc-rhel9

  Version range not reported

• openshift5/network-tools-rhel9

  Version range not reported

• openshift5/oc-mirror-plugin-rhel9

  Version range not reported

• openshift5/ose-agent-installer-api-server-rhel9

  Version range not reported

• openshift5/ose-agent-installer-csr-approver-rhel9

  Version range not reported

• openshift5/ose-baremetal-installer-rhel9

  Version range not reported

• openshift5/ose-cli-artifacts-rhel9

  Version range not reported

• openshift5/ose-cli-rhel9

  Version range not reported

• openshift5/ose-console-rhel9

  Version range not reported

• openshift5/ose-deployer-rhel9

  Version range not reported

• openshift5/ose-helm-rhel9-operator

  Version range not reported

• openshift5/ose-installer-artifacts-rhel9

  Version range not reported

• openshift5/ose-installer-rhel9

  Version range not reported

• openshift5/ose-local-storage-mustgather-rhel9

  Version range not reported

• openshift5/ose-machine-config-rhel9-operator

  Version range not reported

• openshift5/ose-machine-os-images-rhel9

  Version range not reported

• openshift5/ose-must-gather-rhel9

  Version range not reported

• openshift5/ose-olm-catalogd-rhel9

  Version range not reported

• openshift5/ose-olm-operator-controller-rhel9

  Version range not reported

• openshift5/ose-operator-framework-tools-rhel9

  Version range not reported

• openshift5/ose-operator-lifecycle-manager-rhel9

  Version range not reported

• openshift5/ose-operator-registry-rhel9

  Version range not reported

• openshift5/ose-ovn-kubernetes-rhel9

  Version range not reported

• openshift5/ose-secrets-store-csi-mustgather-rhel9

  Version range not reported

• openshift5/ose-tests-rhel9

  Version range not reported

• openshift5/ose-tools-rhel9

  Version range not reported

• openshift5/ptp-must-gather-rhel9

  Version range not reported

• openshift-clients

  Version range not reported

• ose-crio-credential-provider

  Version range not reported

• devspaces/udi-base-rhel10

  Version range not reported

• devspaces/udi-base-rhel9

  Version range not reported

• devspaces/udi-rhel9

  Version range not reported

• rhoso-operators/prometheus-podman-exporter-rhel9

  Version range not reported

• quay/quay-builder-rhel8

  Version range not reported

• quay/quay-builder-rhel9

  Version range not reported

• quay/quay-rhel9

  Version range not reported

References 2