An unauthenticated HTTP server exposed by Podman Desktop allows attackers to trigger denial‑of‑service conditions and extract confidential information, such as internal paths and Windows usernames, by sending crafted requests; the lack of connection limits or timeouts can exhaust file descriptors and kernel memory, causing the application to crash or the host to freeze. The vulnerability results in both a denial‑of‑service attack and information disclosure, and it is classified with weaknesses in information mismanagement (CWE‑209), access control (CWE‑284), denial‑of‑service (CWE‑400), and resource shortage (CWE‑770).

Podman Desktop from the vendor podman‑desktop is affected by this flaw in all releases prior to version 1.26.2; the issue applies to installations on any operating system supported by the application, including Windows, where sensitive data such as usernames may be leaked through verbose error messages.

The CVSS score of 8.2 indicates a high severity, yet the EPSS score is below 1 %, meaning the likelihood of exploitation remains low at present, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw does not require authentication or user interaction and can be exploited remotely from the network, so the attack vector is likely network-based, and once an attacker gains access, they can cause application or host downtime and obtain confidential system details.