CVE-2026-19519
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A flaw in claircore's RPM package scanner allows crafted RPM header data to cause an unchecked type assertion to panic the scanner. The panic is not recovered, crashing the Clair indexer process and leading to denial of service.
Risk Assessment
An attacker can crash the Clair indexer, disrupting container image scanning and potentially causing denial of service.
Recommendation
Update claircore to a patched version and consider adding panic recovery mechanisms in the indexing process.
Original NVD description (English source)
A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service.