Skip to content
OpenAdvisories
High ALSA-2026:28074 3 CVEs

Important: skopeo security update

Published Jun 23, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 9 skopeo 2:1.22.2-6.el9_8
AlmaLinux · 9 skopeo-tests 2:1.22.2-6.el9_8

Vulnerabilities 3

  • High 7.5
    CVE-2026-32280

    Unexpected work during chain building in crypto/x509

    During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-32281

    Inefficient policy validation in crypto/x509

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-32283

    Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

    Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-32280
  • report
    https://access.redhat.com/security/cve/CVE-2026-32281
  • report
    https://access.redhat.com/security/cve/CVE-2026-32283
  • report
    https://bugzilla.redhat.com/2456333
  • report
    https://bugzilla.redhat.com/2456338
  • report
    https://bugzilla.redhat.com/2456339
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-28074.html