Is CVE-2026-19519 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19519 being exploited in the wild.

How severe is CVE-2026-19519?

Medium severity, with a CVSS score of 4.3, published 11 August 2026.

Is there a fix for CVE-2026-19519?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-19519 attacked?

It is attacked over the network.

Am I affected by CVE-2026-19519?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19519: claircore RPM scanner denial of service via unchecked type assertion

CVE-2026-19519 · Severity: medium · CVSS 4.3 · Published 2026-08-11

claircore is an open-source vulnerability scanner component used in container image registries and security platforms like Red Hat Quay and RHACS to identify package vulnerabilities. A flaw in its RPM package parser can be triggered by malformed container image layers, causing the scanner process to crash and temporarily disable image scanning services. While deployments with multiple scanner replicas can mitigate the impact through automatic restart, this creates operational disruption and scanning delays.

Quick answers

Is CVE-2026-19519 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19519 being exploited in the wild.
How severe is CVE-2026-19519?: Medium severity, with a CVSS score of 4.3, published 11 August 2026.
Which products and versions are affected?: claircore claircore <UNKNOWN>.
Is there a fix for CVE-2026-19519?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19519 attacked?: It is attacked over the network.
Am I affected by CVE-2026-19519?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a reachable assertion failure (CWE-617) in claircore's RPM header parser triggered by an unchecked type assertion. An attacker can craft malicious RPM header data in a container layer to trigger an unrecovered panic in the scanner, causing the indexer process to crash. The attack requires network access to push a container with malformed RPM headers, and does not require elevated privileges or user interaction. An attacker can achieve temporary denial of service of the scanning service; the impact is mitigated in multi-replica deployments that automatically restart failed pods. A fix is expected from claircore upstream.

Affected products

claircore claircore <UNKNOWN>

Timeline

2026-08-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.