Medium [CVE-2026-47262] Denial of Service via maliciously crafted image leading to unbounded group parsing
This medium-severity Red Hat Linux advisory covers CVE-2026-47262.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Denial of Service via maliciously crafted image leading to unbounded group parsing. Red Hat rates this moderate (CVSS 6.5).
Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:26990 with package syft-main-1.46.0-0.1.hum1, kubernetes1-36-main-1.36.2-2.hum1, trivy-main-0.72.0-0.1.hum1, kubernetes1-35-main-1.35.6-1.hum1.
- < 1.7.33
- < 2.0.10
- < 2.1.9
- < 2.2.5
- < 2.3.2
Official advisory · high-confidence parse· fetched 1 month ago·verify at source
- syft-main-1.46.0-0.1.hum1
- kubernetes1-36-main-1.36.2-2.hum1
- trivy-main-0.72.0-0.1.hum1
- kubernetes1-35-main-1.35.6-1.hum1
- grype-main-0.115.0-0.1.hum1
- opentelemetry-collector-contrib-main-0.155.0-0.1.hum1
- RHSA-2026:26990
Official advisory · high-confidence parse· fetched 1 month ago·verify at source
Mitigation checklist
- No mitigation is needed for Red Hat products. The vulnerable code path in containerd's CRI plugin group-parsing logic is not executed because Red Hat uses CRI-O as the container runtime. Products that bundle containerd as a library dependency for OCI image operations are not affected.
Official advisory · high-confidence parse· fetched 1 month ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.