CVE-2026-17113

{
  "id": "CVE-2026-17113",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-24T22:16:50.333",
  "lastModified": "2026-10-21T21:17:58.800",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in CRI-O's container-creation environment-variable handling\n(`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in\n`server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI\n`Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries\nunfiltered, in contrast to the normal merge path, which validates each entry for a\n`key=value` form before use. An OCI image whose `config.Env` contains an entry with no\n`=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a\nsingle-element slice and then index its second element, which is out of range. This\ntriggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and\nterminating the container-runtime service for all workloads on the node until it is\nrestarted."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en el manejo de variables de entorno durante la creación de contenedores de CRI-O ('mergeEnvs' en 'server/utils.go', consumido por 'setupContainerEnvironmentyWorkdir' en 'server/container_create.go'). Cuyo una solicitud 'CreateContainer' proporciona un campo 'Envs' de CRI 'nil', CRI-O recurre a usar las entradas 'config.Env' de la imagen OCI de destino sin filtrar, en contraste con la ruta de fusión normal, que valida cada entrada para un formato 'key=value' antes de su uso. Una imagen OCI cuyo 'config.Env' contiene una entrada sin el carácter '=' (por ejemplo, una cadena 'NOEQUALS' simple) hace que CRI-O divida esa entrada en un slice de un solo elemento y luego indexe su segundo elemento, lo cual está fuera de rango. Esto desencadena un pánico de tiempo de ejecución de Go no recuperado en el proceso del demonio 'crio', lo que lo bloquea y termina el servicio de tiempo de ejecución de contenedores para todas las cargas de trabajo en el nodo hasta que se reinicie."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "collectionURL": "https://github.com/cri-o/cri-o",
          "packageName": "cri-o",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.34.11",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "1.35.7",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "1.36.3",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "cri-o",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "openshift/ose-rhel-coreos-8",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "openshift/ose-rhel-coreos-9",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Container Platform 4",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "rhcos",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
          "baseScore": 6.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-27T14:27:12.642586Z",
          "id": "CVE-2026-17113",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1287"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-17113",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506872",
      "source": "[email protected]"
    }
  ]
}