CVE-2026-17113

A flaw was found in CRI-O&amp;#39;s container-creation environment-variable handling<br /> (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in<br /> `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI<br /> `Envs` field, CRI-O falls back to using the target OCI image&amp;#39;s `config.Env` entries<br /> unfiltered, in contrast to the normal merge path, which validates each entry for a<br /> `key=value` form before use. An OCI image whose `config.Env` contains an entry with no<br /> `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a<br /> single-element slice and then index its second element, which is out of range. This<br /> triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and<br /> terminating the container-runtime service for all workloads on the node until it is<br /> restarted.