CVE-2026-17113

/// Technical description

A flaw was found in CRI-O's container-creation environment-variable handling

(`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in

`server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI

`Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries

unfiltered, in contrast to the normal merge path, which validates each entry for a

`key=value` form before use. An OCI image whose `config.Env` contains an entry with no

`=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a

single-element slice and then index its second element, which is out of range. This

triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and

terminating the container-runtime service for all workloads on the node until it is

restarted.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References