Executive brief
Claircore is a library used by container security tools like Clair and Quay to scan container images for vulnerabilities. A flaw in how it processes Alpine Linux (apk) package databases allows a specially crafted container image to crash the scanning service. This can lead to a denial-of-service, preventing the system from successfully indexing and auditing new container images.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the apk package-database parser of Claircore. When the scanner encounters malformed data within a container layer, it triggers a Go panic due to an out-of-bounds slice access. Because this panic is not recovered within the indexing path, it causes the entire Clair indexer process to terminate. An attacker with the ability to submit a crafted container image for indexing can exploit this to cause a denial of service. While the impact may be mitigated by automatic container orchestration restarts (e.g., Kubernetes), it still results in a disruption of the indexing service.
Affected products
- Quay Claircore
- Red Hat Red Hat Advanced Cluster Security 4
Timeline
- 2026-07-20: disclosed: Vulnerability reported via Red Hat Bugzilla and NVD.