Input validation error in CRI-O - CVE-2026-17113
Published: August 25, 2026
Vulnerability identifier: #VU145354
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-17113
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to improper input validation in CRI-O daemon when processing a crafted OCI image with a malformed environment variable entry. A local privileged user can supply a specially crafted OCI image to cause a denial of service.
This only occurs when no environment variables are set in the container spec, and the normal Kubernetes API path does not trigger the issue.
Affected software
CRI-O
Fedora
cri-o1.36
Fedora
cri-o1.36
How to mitigate CVE-2026-17113
Install security update from vendor's website.
CRI-O - addressed in versions 1.34.12, 1.35.7, 1.36.4
cri-o1.36 - addressed in versions 1.36.6-1.fc43, 1.36.6-1.fc44, 1.36.6-1.fc45, 1.36.6-1.fc46
cri-o1.36 - addressed in versions 1.36.6-1.fc43, 1.36.6-1.fc44, 1.36.6-1.fc45, 1.36.6-1.fc46