EUVD-2026-45900
GHSA-985f-wwqg-mmx8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-accessible via image push requiring low-privilege credentials; availability-only impact from process crash; no confidentiality or integrity consequence confirmed.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the scanner. If that panic is not recovered, the Clair indexer process can crash, leading to a denial of service.
AnalysisAI
Denial of service in claircore's Alpine APK package scanner affects Red Hat Advanced Cluster Security 4 and Red Hat Quay 3, where a low-privileged remote attacker can submit a container image containing malformed APK package-database data to trigger an out-of-bounds read (CWE-125) that panics the Go scanner. If the panic is not recovered, the Clair indexer process crashes, interrupting container vulnerability scanning workflows. No public exploit code exists and this CVE is not listed in the CISA KEV catalog, placing this at moderate priority despite network reachability.
Technical ContextAI
claircore is an open-source Go library underlying the Clair container vulnerability scanner, used by Red Hat products including Advanced Cluster Security 4 (ACS, cpe:2.3:a:red_hat:red_hat_advanced_cluster_security_4) and Red Hat Quay 3 (cpe:2.3:a:red_hat:red_hat_quay_3). The apk package scanner within claircore parses Alpine Linux's package database format when indexing container image layers. CWE-125 (Out-of-bounds Read) indicates the scanner reads beyond the boundary of a controlled buffer when processing attacker-controlled package-database entries. In Go, an out-of-bounds slice or array access that is not wrapped in a recovery mechanism produces an unhandled panic, which terminates the goroutine - and if unrecovered, the entire indexer process. The tags in the intelligence data also reference 'Buffer Overflow' and 'Information Disclosure,' though the CVSS vector reflects no confidentiality impact (C:N), suggesting the out-of-bounds read's primary confirmed consequence is availability loss rather than data leakage; this discrepancy should be verified with the Red Hat advisory.
RemediationAI
The primary remediation is to apply the vendor-released patch from Red Hat once available; consult the advisory at https://access.redhat.com/security/cve/CVE-2026-16254 and the Bugzilla tracker at https://bugzilla.redhat.com/show_bug.cgi?id=2502701 for specific patched version numbers, which were not confirmed in the available intelligence data. No exact fix version was independently verifiable from the provided references. As a compensating control, restrict which users or service accounts can push container images to Quay 3 registries or submit images for ACS scanning to the minimum necessary set of trusted principals - this reduces the attack surface by limiting who can supply malformed APK data. Organizations can also monitor Clair indexer process health and configure process supervisors (e.g., systemd, Kubernetes liveness probes) to automatically restart the indexer on crash, mitigating the DoS impact at the cost of temporary scanning unavailability during restart. If Alpine-based image scanning is not required in a given environment, disabling APK layer processing would eliminate exposure but would reduce vulnerability coverage for Alpine containers.
More in Red Hat Quay 3
View allAuthenticated remote code execution in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift arises from unsafe deser
Red Hat Quay 3 and Red Hat OpenShift Update Service expose an unauthenticated security scanner notification endpoint whe
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessibl
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the
Red Hat Quay's container image upload mechanism allows authenticated users with push privileges to interfere with concur
Robot account token disclosure in Red Hat Quay 3 allows a user assigned to the GLOBAL_READONLY_SUPER_USERS role to read
Server-Side Request Forgery in Red Hat Quay's build API allows an authenticated user with repository write access to piv
Server-Side Request Forgery in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift 2 allows an authenticated reposi
LDAP injection in Red Hat Quay 3's external LDAP authentication handler allows unauthenticated network attackers to inje
Server-side request forgery (SSRF) in Red Hat Mirror Registry and Red Hat Quay 3.x allows authenticated users to conduct
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to
Server-Side Request Forgery (SSRF) in Red Hat Quay's Proxy Cache configuration allows authenticated organization adminis
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today