CVE-2026-79699

Fixed in a distro release EPSS <1%CVSS 4.4

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Published 2026-09-15 · CVE record · OSV

Products: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, Red Hat OpenShift Virtualization 4, Red Hat Quay 3

Distro releases