CVE-2026-16254

MediumCVSS 4.3

Published: 20/07/2026(UTC)Updated: 21/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

Vulnerability in claircore's apk package scanner. Malicious package database data in a container layer can cause an out-of-bounds access, leading to a scanner panic. If the panic is not recovered, the Clair indexer process can crash, causing denial of service.

Risk Assessment

Risk involves Clair indexer crash, preventing container image scanning and potentially disrupting CI/CD pipelines.

Recommendation

Update claircore to a patched version and implement panic recovery mechanisms.

Other vulnerabilities in claircore

CVE-2026-19519Medium
A flaw in claircore's RPM package scanner allows crafted RPM header data to cause an unchecked type assertion to panic the scanner. The panic is not recovered, crashing the Clair indexer process and leading to denial of service.

Original NVD description (English source)

A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the scanner. If that panic is not recovered, the Clair indexer process can crash, leading to a denial of service.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS