Description

A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-11T08:17:20.880Z",
  "pubdate": "2026-08-11T08:17:20.880Z",
  "executiveSummary": "A denial of service vulnerability exists in the claircore RPM package scanner component. The flaw arises from improper handling of crafted RPM header data embedded within a container layer, which triggers an unchecked type assertion resulting in an unrecovered runtime panic.\nSuccessful exploitation of this vulnerability leads to the immediate crash of the Clair indexer process, causing a complete denial of service for the container image vulnerability indexing pipeline. The risk implication is operational disruption, as security scanning pipelines become unavailable when processing malicious or malformed container layers.\nAttacker capabilities require the ability to supply or influence a container image layer containing a specially crafted RPM package with malicious header data. No authentication or elevated privileges are required if the indexing service automatically processes untrusted container registries or user-submitted images, and the attack vector is triggered remotely via standard container scanning workflows.",
  "technicalDetails": "The vulnerability resides in the claircore RPM package scanner, specifically within the logic responsible for parsing RPM header data extracted from container layers. The root cause of the flaw is an unchecked type assertion performed on the parsed header data structures.\nWhen claircore processes a container layer containing a maliciously crafted RPM package, the scanner attempts to assert the data type of specific RPM header fields without validating the underlying concrete type. Because the input header data deviates from the expected schema, the type assertion fails at runtime.\nIn the Go programming language, an unchecked type assertion that fails on an interface value causes the goroutine to trigger a runtime panic. Since the panic is not intercepted or recovered via a deferred recovery function within the scanning execution flow, it propagates up the call stack and terminates the entire Clair indexer process.\nThe attack flow proceeds as follows: 1) An attacker constructs a malicious container image layer containing an RPM package with manipulated header structures designed to violate expected type constraints. 2) A user or automated system submits the container image to Clair for vulnerability indexing. 3) The claircore RPM package scanner parses the container layer and encounters the malformed RPM header. 4) The scanner executes an unchecked type assertion on the malicious header data, causing a runtime panic. 5) The unrecovered panic crashes the Clair indexer process, resulting in a denial of service preventing further container image analysis."
}