EUVD-2026-55974
GHSA-639x-pgq6-48g2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Image submission is network-reachable (AV:N), requires low-privilege push access (PR:L), and causes only a recoverable process crash with no data exposure (C:N/I:N/A:L).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service.
AnalysisAI
Denial of service in claircore's RPM package scanner allows an authenticated attacker to crash the Clair indexer process by submitting a container image with crafted RPM header data. The malformed header triggers an unchecked Go type assertion panic that is never recovered, terminating the entire indexer process and disrupting container vulnerability scanning for all users of the affected instance. No public exploit identified at time of analysis; CVSS scores this at 4.3 (Medium), reflecting the low-privilege access requirement and bounded availability impact.
Technical ContextAI
claircore is an open-source Go library that powers Clair, a container image vulnerability scanner widely used with registries such as Quay.io. Its RPM package scanner reads and parses RPM header data from container image layers to enumerate installed packages for vulnerability correlation. CWE-617 (Reachable Assertion) identifies the root cause: a Go type assertion performed without the 'comma ok' idiom. When the asserted interface type does not match the underlying concrete type, Go panics unconditionally. Because the RPM scanner does not wrap this code path in a recover() handler, the panic propagates up the call stack and terminates the indexer process entirely rather than returning a per-image error. The vulnerability is reachable from the network because container images containing RPM-based layers are ingested and parsed automatically by the scanner upon submission.
Affected ProductsAI
The vulnerability resides in the claircore library's RPM package scanner component, as confirmed by Red Hat (secalert@redhat.com) and tracked under Bugzilla report BZ#2513781. The Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-19519 is the authoritative source for confirmed affected version ranges; no explicit version range is derivable from the provided data alone. Deployments of Clair or any downstream consumer of claircore that scan RPM-based container images (e.g., RHEL, CentOS, Fedora base images) are potentially in scope.
RemediationAI
Upgrade to a patched version of claircore as detailed in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-19519 and the associated Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2513781. A confirmed patch version is not independently derivable from the available data - verify the exact fixed release against the upstream claircore repository and the Red Hat advisory before deploying. As an interim compensating control, restrict image submission privileges so that only trusted, internal systems or authenticated CI pipelines can push images for scanning, reducing exposure to attacker-controlled RPM content. Implementing process supervision - such as systemd restart-on-failure policies or Kubernetes liveness probes - to automatically restart the Clair indexer after a crash will reduce operational impact but does not prevent exploitation and should not substitute for patching.
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today