CVE-2026-114236
Low · 3.3CVSS
3.3
EPSS
0.1%
Published
Oct 21, 2026
CISA due date
—
The record
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-90870 A missing release of backend receiver sessions in the Ad Hoc Transfer component of… CWE-772
- CVE-2026-112200 P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session… CWE-772
- CVE-2026-115793 P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that… CWE-772
- CVE-2026-118262 Echo is a Go web framework. CWE-772
- CVE-2026-59951 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-772
- CVE-2026-104031 A flaw was found in SSSD. CWE-772
- CVE-2026-18149 undici's retry handler can leave an already-exposed response body pending forever. CWE-772
- CVE-2026-71380 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets… CWE-772