Summary
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Security Fix(es):
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
Bug Fix(es) and Enhancement(s):
* user_u SELinux user can't run podman containers as rootless (JIRA:AlmaLinux-135342)
* podman does not clean up all files and leaves orphaned files consuming disk space [almalinux-8.10.z] (JIRA:AlmaLinux-173978)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 77
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | aardvark-dns | 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux · 8 | aardvark-dns | 2:1.10.1-2.module_el8.10.0+4089+ce72bbbe |
| AlmaLinux · 8 | aardvark-dns | 2:1.10.1-2.module_el8.10.0+4047+545787c4 |
| AlmaLinux · 8 | aardvark-dns | 2:1.10.1-2.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux · 8 | buildah | 2:1.33.14-3.module_el8.10.0+4211+49ea0979 |
| AlmaLinux · 8 | buildah-tests | 2:1.33.14-3.module_el8.10.0+4211+49ea0979 |
| AlmaLinux · 8 | buildah-tests | 2:1.33.14-3.module_el8.10.0+4136+16425343 |
| AlmaLinux · 8 | cockpit-podman | 84.1-1.module_el8.10.0+4102+6c76e544 |
| AlmaLinux · 8 | conmon | 3:2.1.10-1.module_el8.10.0+3970+8445edf6 |
| AlmaLinux · 8 | conmon | 3:2.1.10-1.module_el8.10.0+4090+91932338 |
| AlmaLinux · 8 | conmon | 3:2.1.10-1.module_el8.10.0+4068+0e21408f |
| AlmaLinux · 8 | container-selinux | 2:2.229.0-3.module_el8.10.0+4211+49ea0979 |
| AlmaLinux · 8 | containernetworking-plugins | 1:1.4.0-8.module_el8.10.0+4136+16425343 |
| AlmaLinux · 8 | containers-common | 2:1-82.module_el8.10.0+3876+e55593a8 |
| AlmaLinux · 8 | containers-common | 2:1-82.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux · 8 | containers-common | 2:1-82.module_el8.10.0+4089+ce72bbbe |
| AlmaLinux · 8 | crit | 3.18-5.module_el8.10.0+4047+545787c4 |
| AlmaLinux · 8 | crit | 3.18-5.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux · 8 | crit | 3.18-5.module_el8.10.0+4120+03ad4b47 |
| AlmaLinux · 8 | crit | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | criu | 3.18-5.module_el8.10.0+4089+ce72bbbe |
| AlmaLinux · 8 | criu | 3.18-5.module_el8.10.0+4120+03ad4b47 |
| AlmaLinux · 8 | criu | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux · 8 | criu | 3.18-5.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux · 8 | criu-devel | 3.18-5.module_el8.10.0+4016+efd18bf8 |
| AlmaLinux · 8 | criu-devel | 3.18-5.module_el8.10.0+4089+ce72bbbe |
| AlmaLinux · 8 | criu-devel | 3.18-5.module_el8.10.0+4068+0e21408f |
| AlmaLinux · 8 | criu-devel | 3.18-5.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux · 8 | criu-libs | 3.18-5.module_el8.10.0+3970+8445edf6 |
| AlmaLinux · 8 | criu-libs | 3.18-5.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux · 8 | criu-libs | 3.18-5.module_el8.10.0+3926+f12484f5 |
| AlmaLinux · 8 | criu-libs | 3.18-5.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux · 8 | crun | 1.14.3-2.module_el8.10.0+4120+03ad4b47 |
| AlmaLinux · 8 | crun | 1.14.3-2.module_el8.10.0+4102+6c76e544 |
| AlmaLinux · 8 | crun | 1.14.3-2.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux · 8 | fuse-overlayfs | 1.13-1.module_el8.10.0+4047+545787c4 |
| AlmaLinux · 8 | fuse-overlayfs | 1.13-1.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux · 8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3792+03eaed9c |
| AlmaLinux · 8 | fuse-overlayfs | 1.13-1.module_el8.10.0+4068+0e21408f |
| AlmaLinux · 8 | libslirp | 4.4.0-2.module_el8.10.0+4023+db236c53 |
| AlmaLinux · 8 | libslirp | 4.4.0-2.module_el8.10.0+4090+91932338 |
| AlmaLinux · 8 | libslirp | 4.4.0-2.module_el8.10.0+4089+ce72bbbe |
| AlmaLinux · 8 | libslirp | 4.4.0-2.module_el8.10.0+4120+03ad4b47 |
| AlmaLinux · 8 | libslirp-devel | 4.4.0-2.module_el8.10.0+4102+6c76e544 |
| AlmaLinux · 8 | libslirp-devel | 4.4.0-2.module_el8.10.0+4068+0e21408f |
| AlmaLinux · 8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3970+8445edf6 |
| AlmaLinux · 8 | libslirp-devel | 4.4.0-2.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux · 8 | netavark | 2:1.10.3-1.module_el8.10.0+4120+03ad4b47 |
| AlmaLinux · 8 | netavark | 2:1.10.3-1.module_el8.10.0+4023+db236c53 |
| AlmaLinux · 8 | netavark | 2:1.10.3-1.module_el8.10.0+3970+8445edf6 |
| AlmaLinux · 8 | netavark | 2:1.10.3-1.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux · 8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+4047+545787c4 |
| AlmaLinux · 8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+4120+03ad4b47 |
| AlmaLinux · 8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux · 8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+4068+0e21408f |
| AlmaLinux · 8 | podman | 4:4.9.4-31.module_el8.10.0+4211+49ea0979 |
| AlmaLinux · 8 | podman-catatonit | 4:4.9.4-31.module_el8.10.0+4211+49ea0979 |
| AlmaLinux · 8 | podman-docker | 4:4.9.4-31.module_el8.10.0+4211+49ea0979 |
| AlmaLinux · 8 | podman-gvproxy | 4:4.9.4-31.module_el8.10.0+4211+49ea0979 |
| AlmaLinux · 8 | podman-plugins | 4:4.9.4-31.module_el8.10.0+4211+49ea0979 |
| AlmaLinux · 8 | podman-remote | 4:4.9.4-31.module_el8.10.0+4211+49ea0979 |
| AlmaLinux · 8 | podman-tests | 4:4.9.4-31.module_el8.10.0+4211+49ea0979 |
| AlmaLinux · 8 | python3-criu | 3.18-5.module_el8.10.0+3970+8445edf6 |
| AlmaLinux · 8 | python3-criu | 3.18-5.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux · 8 | python3-criu | 3.18-5.module_el8.10.0+4120+03ad4b47 |
| AlmaLinux · 8 | python3-criu | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux · 8 | python3-podman | 4.9.0-3.module_el8.10.0+4016+efd18bf8 |
| AlmaLinux · 8 | runc | 4:1.2.9-4.module_el8.10.0+4136+16425343 |
| AlmaLinux · 8 | skopeo | 2:1.14.6-2.module_el8.10.0+4211+49ea0979 |
| AlmaLinux · 8 | skopeo-tests | 2:1.14.6-2.module_el8.10.0+4211+49ea0979 |
| AlmaLinux · 8 | slirp4netns | 1.2.3-1.module_el8.10.0+4047+545787c4 |
| AlmaLinux · 8 | slirp4netns | 1.2.3-1.module_el8.10.0+4023+db236c53 |
| AlmaLinux · 8 | slirp4netns | 1.2.3-1.module_el8.10.0+3926+f12484f5 |
| AlmaLinux · 8 | slirp4netns | 1.2.3-1.module_el8.10.0+4082+f7f0c95e |
| AlmaLinux · 8 | toolbox | 0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47 |
| AlmaLinux · 8 | toolbox-tests | 0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47 |
| AlmaLinux · 8 | udica | 0.2.6-21.module_el8.10.0+4068+0e21408f |
Vulnerabilities 5
-
High 7.5
Incorrect parsing of IPv6 host literals in net/url
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
-
High 7.5
Unexpected work during chain building in crypto/x509
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…
-
High 7.5
Inefficient policy validation in crypto/x509
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…
-
High 7.5
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
-
High 7.5
Go JOSE affect by a panic in JWE decryption
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-25679
-
report
https://access.redhat.com/security/cve/CVE-2026-32280
-
report
https://access.redhat.com/security/cve/CVE-2026-32281
-
report
https://access.redhat.com/security/cve/CVE-2026-32283
-
report
https://access.redhat.com/security/cve/CVE-2026-34986
-
report
https://bugzilla.redhat.com/2445356
-
report
https://bugzilla.redhat.com/2455470
-
report
https://bugzilla.redhat.com/2456333
-
report
https://bugzilla.redhat.com/2456338
-
report
https://bugzilla.redhat.com/2456339
-
advisory
https://errata.almalinux.org/8/ALSA-2026-33722.html