6

CVE-2026-17113

Cri-o: cri-o: unvalidated image env var causes daemon crash

A flaw was found in CRI-O's container-creation environment-variable handling
(`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in
`server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI
`Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries
unfiltered, in contrast to the normal merge path, which validates each entry for a
`key=value` form before use. An OCI image whose `config.Env` contains an entry with no
`=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a
single-element slice and then index its second element, which is out of range. This
triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and
terminating the container-runtime service for all workloads on the node until it is
restarted.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Collection URLhttps://github.com/cri-o/cri-o
≫
Paket cri-o
Version 0
Version < 1.34.11
Status affected
Version 0
Version < 1.35.7
Status affected
Version 0
Version < 1.36.3
Status affected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4
Default Statusaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.11% 0.012
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 6 1.5 4
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
CWE-1287 Improper Validation of Specified Type of Input

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

https://access.redhat.com/security/cve/CVE-2026-17113
https://bugzilla.redhat.com/show_bug.cgi?id=2506872