Bug 2513781 (CVE-2026-19519)

Summary: CVE-2026-19519 claircore: claircore: denial of service via unchecked type assertion in RPM header parser
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aruklets, doconnor
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-11 06:19:12 UTC 
A flaw was found in claircore's RPM package scanner. The Info.Load function uses bare type assertions to cast values returned by ReadData into expected Go types. An attacker who can push an image containing a crafted RPM database can declare a tag with a type that passes the class-based checkTagType validation but returns a different Go concrete type from ReadData, causing an unrecoverable panic that crashes the Clair indexer process. The panic propagates through x/sync/errgroup and is not caught by Clair's catchAbort middleware, resulting in a denial of service affecting all users of the shared indexer. Additionally, zero-count array-typed tags cause index-out-of-range panics through the same unrecovered path.