Summary
The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.
Security Fix(es):
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | runc | 4:1.4.2-2.el9_8 |
Vulnerabilities 3
-
High 7.5
Incorrect parsing of IPv6 host literals in net/url
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
-
High 7.5
Unexpected work during chain building in crypto/x509
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…
-
High 7.5
Inefficient policy validation in crypto/x509
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-25679
-
report
https://access.redhat.com/security/cve/CVE-2026-32280
-
report
https://access.redhat.com/security/cve/CVE-2026-32281
-
report
https://bugzilla.redhat.com/2445356
-
report
https://bugzilla.redhat.com/2456333
-
report
https://bugzilla.redhat.com/2456339
-
advisory
https://errata.almalinux.org/9/ALSA-2026-29702.html