{"id":"CVE-2026-17113","summary":"Cri-o: cri-o: unvalidated image env var causes daemon crash","details":"A flaw was found in CRI-O's container-creation environment-variable handling\n(`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in\n`server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI\n`Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries\nunfiltered, in contrast to the normal merge path, which validates each entry for a\n`key=value` form before use. An OCI image whose `config.Env` contains an entry with no\n`=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a\nsingle-element slice and then index its second element, which is out of range. This\ntriggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and\nterminating the container-runtime service for all workloads on the node until it is\nrestarted.","modified":"2026-08-30T03:31:01.203256491Z","published":"2026-08-24T21:22:49.638Z","database_specific":{"cna_assigner":"redhat","cwe_ids":["CWE-1287"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17113.json"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-17113"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17113.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17113"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506872"},{"type":"PACKAGE","url":"https://github.com/cri-o/cri-o"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cri-o/cri-o","events":[{"introduced":"0"},{"fixed":"33a39f806928b6b9798abf491ed8909991b988da"},{"fixed":"e79a9cbff48f30781b8c54cdbc589a372a113896"},{"fixed":"b24632ab44955fa84685640d4177f3c554e9f69c"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.34.11"},{"fixed":"1.35.7"},{"fixed":"1.36.3"}],"source":"AFFECTED_FIELD"}}],"versions":["v1.35.6","v1.35.5","v1.34.10","v1.36.2","v1.34.9","v1.35.4","v1.36.1","v1.35.3","v1.36.0","v1.34.8","v1.34.7","v1.35.2","v1.34.6","v1.35.1","v1.34.5","v1.35.0","v1.34.4","v1.34.3","v1.34.2","v1.34.1","v1.34.0","v1.33.0","v1.32.0","v1.31.0","v1.30.0","v1.29.0","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.0","v1.22.0","v1.21.0","v1.18.0-rc1","v1.9.0-beta.2","v1.9.0-beta.1","v1.0.0-rc1","v1.0.0-beta.0","v1.0.0-alpha.0","v0.3","v0.2","v0.1","v0.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-17113.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H"}]}