A flaw was found in claircore's RPM package scanner. The Info.Load function uses bare type assertions to cast values returned by ReadData into expected Go types. An attacker who can push an image containing a crafted RPM database can declare a tag with a type that passes the class-based checkTagType validation but returns a different Go concrete type from ReadData, causing an unrecoverable panic that crashes the Clair indexer process. The panic propagates through x/sync/errgroup and is not caught by Clair's catchAbort middleware, resulting in a denial of service affecting all users of the shared indexer. Additionally, zero-count array-typed tags cause index-out-of-range panics through the same unrecovered path.