CVE-2026-34045

BRIEFING NOTE: CVE-2026-34045 OVERVIEW Podman Desktop versions prior to 1.26.2 contain a critical vulnerability in an unauthenticated HTTP server that allows remote attackers to trigger denial-of-service conditions and extract sensitive information. The flaw stems from missing connection limits and timeouts, combined with verbose error responses that disclose internal system details including file paths and usernames. SEVERITY This vulnerability carries a CVSS score of 9.1 (Critical) with a network-based attack vector requiring no authentication, user interaction, or special privileges. The attack exploits insufficient resource management to exhaust file descriptors and kernel memory, potentially causing application crashes or complete host system freeze. Additionally, the exposure of sensitive information such as internal paths and Windows usernames significantly aids further exploitation and reconnaissance activities. EXPLOITATION STATUS There is currently no indication of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. However, the relatively high CVSS score and straightforward attack surface warrant immediate patching. Organizations running Podman Desktop should upgrade to version 1.26.2 or later without delay to eliminate this critical exposure.