Executive brief
claircore is an open-source vulnerability scanner component used in container image registries and security platforms like Red Hat Quay and RHACS to identify package vulnerabilities. A flaw in its RPM package parser can be triggered by malformed container image layers, causing the scanner process to crash and temporarily disable image scanning services. While deployments with multiple scanner replicas can mitigate the impact through automatic restart, this creates operational disruption and scanning delays.
Technical details
The vulnerability is a reachable assertion failure (CWE-617) in claircore's RPM header parser triggered by an unchecked type assertion. An attacker can craft malicious RPM header data in a container layer to trigger an unrecovered panic in the scanner, causing the indexer process to crash. The attack requires network access to push a container with malformed RPM headers, and does not require elevated privileges or user interaction. An attacker can achieve temporary denial of service of the scanning service; the impact is mitigated in multi-replica deployments that automatically restart failed pods. A fix is expected from claircore upstream.
Affected products
- claircore claircore <UNKNOWN>
Timeline
- 2026-08-11: disclosed