CVE-2026-19519: claircore RPM Scanner DoS Vulnerability

CVE-2026-19519 Overview

CVE-2026-19519 is a denial-of-service vulnerability in claircore, the container image scanning library used by the Clair vulnerability scanner. The flaw resides in the RPM package scanner, where crafted RPM header data inside a container layer triggers an unchecked type assertion. The resulting panic is not recovered, causing the Clair indexer process to crash. An attacker with the ability to submit container images for scanning can repeatedly crash the indexer, disrupting vulnerability analysis pipelines. The issue is tracked under [CWE-617: Reachable Assertion].

Critical Impact
An authenticated attacker can crash the Clair indexer by supplying a container layer containing malformed RPM header data, disrupting vulnerability scanning workflows in CI/CD and registry pipelines.

Affected Products

claircore (RPM package scanner component)
Clair vulnerability scanner (indexer process)
Red Hat Quay and downstream products embedding claircore

Discovery Timeline

2026-08-11 - CVE-2026-19519 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-19519

Vulnerability Analysis

The vulnerability exists in claircore's RPM scanner, which parses RPM package metadata from filesystem layers inside container images. During header parsing, the scanner performs a Go type assertion on values extracted from the RPM header structure. When the underlying value does not match the asserted type, the runtime raises a panic. Because no recover() guards the surrounding call path, the panic propagates up and terminates the Clair indexer process.

An attacker able to submit container images for indexing can weaponize this behavior by crafting an RPM database entry with unexpected header field types. Each scan attempt against the malicious layer crashes the indexer, blocking legitimate scans and creating gaps in vulnerability visibility. The flaw impacts availability only; confidentiality and integrity are not affected.

Root Cause

The root cause is an unchecked Go type assertion of the form value.(ExpectedType) on data derived from attacker-controlled RPM header entries. Idiomatic safe assertions use the two-value form (v, ok := value.(T)) to test the assertion before use. The single-value form panics on mismatch, and the calling goroutine lacks a deferred recovery handler, so the entire process exits.

Attack Vector

Exploitation requires the attacker to supply a container image to a Clair-based scanning workflow. Common exposure paths include public or shared container registries scanned by Quay, CI systems that submit images to a Clair indexer, and multi-tenant scanning services. The attack requires low privileges (submitting an image) and no user interaction. Each malicious layer submitted results in an indexer crash, enabling repeated denial of service.

No verified public proof-of-concept is available at this time. Refer to the Red Hat CVE-2026-19519 Advisory and Red Hat Bug Report #2513781 for authoritative technical details.

Detection Methods for CVE-2026-19519

Indicators of Compromise

Repeated Clair indexer process crashes or restarts correlated with specific image scan requests
Go runtime panic stack traces referencing the claircore RPM scanner package in indexer logs
Failed or stuck index reports for specific container manifests submitted by the same tenant or client
Elevated container orchestrator restart counts for the Clair indexer pod or service

Detection Strategies

Parse Clair indexer stdout/stderr for panic: messages containing RPM scanner call frames and alert on recurrence.
Track indexer process uptime and restart frequency; sustained crash loops tied to indexing activity indicate exploitation attempts.
Correlate crash timestamps with the manifest digests being scanned to identify the offending image and submitter.

Monitoring Recommendations

Enable structured logging on the Clair indexer and forward panic events to a centralized SIEM for alerting.
Instrument the indexer with process health probes and export crash counters to Prometheus or an equivalent metrics backend.
Audit registry push events and API submissions to Clair to attribute malicious image uploads to a specific identity.

How to Mitigate CVE-2026-19519

Immediate Actions Required

Apply the patched claircore and Clair packages once published by Red Hat; track the Red Hat CVE-2026-19519 Advisory for fixed version numbers.
Restrict image submission to trusted identities and enforce authentication on all Clair indexer API endpoints.
Deploy the Clair indexer behind a supervisor (systemd, Kubernetes) that automatically restarts crashed processes to reduce downtime.

Patch Information

Red Hat has tracked this issue in Bugzilla #2513781. Consult the vendor advisory for the specific fixed versions of claircore, Clair, and Red Hat Quay. Upgrade all instances of the indexer as coordinated releases become available.

Workarounds

Limit which tenants or accounts can submit new container images for scanning until patches are deployed.
Isolate the indexer in a dedicated process or container with automatic restart policies to preserve availability during crash attempts.
Rate-limit indexing requests per client to slow repeated exploitation and provide time to investigate crash sources.

bash

# Example: Kubernetes restart policy and liveness probe for the Clair indexer
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      restartPolicy: Always
      containers:
        - name: clair-indexer
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 15