CVE-2026-34045

[CVE catalog]

Severity

High · CVSS 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Published

Apr 7, 2026, 8:52:32 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.47% · Oct 25, 2026

A flaw was found in Podman Desktop. A remote attacker can exploit an unauthenticated HTTP server, which lacks proper connection limits and timeouts, to trigger denial-of-service (DoS) conditions. This can lead to application crashes or a complete host freeze. Additionally, verbose error responses from the server may disclose sensitive information, such as internal file paths and system details, including usernames on Windows systems. podman-desktop: Podman Desktop: Denial of Service and Information Disclosure via unauthenticated HTTP server Podman Desktop is vulnerable to denial-of-service and information disclosure. An unauthenticated HTTP server, lacking proper connection limits, allows remote attackers to trigger application crashes or host freezes. Additionally, verbose error responses may expose sensitive internal paths and system details. This affects Red Hat Enterprise Linux versions shipping Podman Desktop. Red Hat Product Security has rated this vulnerability as having the severity of Important as it allows remote unauthenticated users to compromise system availability (A:H), additionally the leak of sensitive path information leakage in error message may allow the attacker to gain knowledge about the environment on which podman-desktop is running. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.