CVE-2026-17113: Improper Validation of Specified Type of Input
Description
CVE-2026-17113 is a vulnerability in CRI-O's handling of container environment variables during container creation. When a CreateContainer request provides a nil environment variable field, CRI-O uses the OCI image's environment variables without validating their format. If an environment variable lacks an '=' character, CRI-O attempts to access a non-existent array element, causing a runtime panic that crashes the crio daemon and disrupts container runtime services on the node until restarted.
CVSS v3.1
Score 6.0medium
Affected software
Red Hat
Red Hat OpenShift Container Platform 4
pkg:github/cri-oRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from improper validation of environment variable entries in CRI-O's container creation process. Specifically, when the CRI Envs field is nil, CRI-O falls back to the OCI image's config.Env entries without filtering for the required 'key=value' format. If an entry lacks the '=' character, CRI-O splits the string and attempts to access an out-of-range index, triggering a Go runtime panic. This crash terminates the crio daemon process, causing a denial of service for all container workloads on the affected node until manual restart.
Potential Impact
The vulnerability leads to a denial of service condition by crashing the crio daemon, which stops the container runtime service on the node. This affects availability but does not impact confidentiality or integrity. The CVSS 3.1 score is 6.0 (medium severity) with local attack vector, low attack complexity, high privileges required, no user interaction, and scope changed.
Mitigation Recommendations
A fix is available in CRI-O versions 1.34.11, 1.35.7, and 1.36.3 and later. Users should upgrade to these or newer versions to remediate the issue. No vendor advisory indicates alternative mitigations or that no action is required. Until patched, avoid using OCI images with malformed environment variables lacking '=' characters.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-24T15:50:17.184Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-17113","vendor":"Red Hat"}]
Threat ID: 6a8cb9abacd9273b4928caef
Added to database: 08/24/2026, 21:37:47 UTC
Last enriched: 09/10/2026, 21:03:26 UTC
Last updated: 10/07/2026, 06:48:14 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.