Skip to content
OpenAdvisories
High ALSA-2026:24470 3 CVEs

Important: podman security update

Published Jun 8, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
AlmaLinux · 10 podman 7:5.8.2-3.el10_2.alma.1
AlmaLinux · 10 podman-docker 7:5.8.2-3.el10_2.alma.1
AlmaLinux · 10 podman-remote 7:5.8.2-3.el10_2.alma.1
AlmaLinux · 10 podman-tests 7:5.8.2-3.el10_2.alma.1

Vulnerabilities 3

  • High 7.5
    CVE-2026-32280

    Unexpected work during chain building in crypto/x509

    During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-32281

    Inefficient policy validation in crypto/x509

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-32283

    Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

    Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-32280
  • report
    https://access.redhat.com/security/cve/CVE-2026-32281
  • report
    https://access.redhat.com/security/cve/CVE-2026-32283
  • report
    https://bugzilla.redhat.com/2456333
  • report
    https://bugzilla.redhat.com/2456338
  • report
    https://bugzilla.redhat.com/2456339
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-24470.html