Denial-of-Service Vulnerability in Podman Desktop by Red Hat

CVE-2026-34045

What is CVE-2026-34045?

Podman Desktop, a graphical tool for container and Kubernetes development, prior to version 1.26.2, includes an unauthenticated HTTP server that may enable network attackers to induce denial-of-service conditions and extract sensitive information. The lack of connection limits and timeouts can lead to exhaustion of system resources, including file descriptors and kernel memory, potentially resulting in application crashes or complete system freezes. Furthermore, verbose error messages unintentionally disclose critical internal paths and sensitive system details, such as usernames on Windows systems, which could facilitate additional cyber exploits. Users are strongly advised to upgrade to version 1.26.2 to mitigate these security risks.

References