storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; repeated calls can exhaust the process’ file descriptor limit, causing the container runtime to fail or become unresponsive. The vulnerability is a resource‑exhaustion flaw identified as CWE‑772 and could lead to availability loss for services that depend on Podman or its derivatives.

Red Hat products utilizing Podman, such as Advanced Cluster Security 4, Ansible Automation Platform 2, OpenShift Container Platform 4, OpenShift Dev Spaces 3, OpenShift AI, OpenShift Lightspeed, Podman Desktop, Quay 3, and RHEL 9 and RHEL 10 images, are affected. The vulnerability may impact any deployment that pulls or builds images containing malformed layers.

With a CVSS score of 3.3 and an EPSS of <1%, the risk is considered low, and the vulnerability is not listed in CISA KEV. Attacking this flaw requires control over image layers or the ability to inject malformed layers into a container runtime. Successful exploitation could trigger file‑descriptor exhaustion and cause a denial of service for the affected container or host. The availability impact may be significant in high‑traffic or critical environments if the vulnerable component is a central orchestrator or registry.