High ELSA-2026-19017 2 CVEs

Important: podman security update (Oracle Linux 10)

Published Jul 8, 2026 · Updated Jul 8, 2026

Ecosystem: Oracle Linux

Summary

[5.8.2-1.0.1]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]

[7:5.8.2-1]
- update to https://github.com/containers/podman/releases/tag/v5.8.2
- fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE
- Resolves: RHEL-165012

[7:5.8.1-1]
- update to https://github.com/containers/podman/releases/tag/v5.8.1
- fixes Update Podman to support TLS 1.3 configuration
- Resolves: RHEL-153732

[7:5.8.0-2]
- enable sequoia
- Resolves: RHEL-56365

[7:5.8.0-1]
- update to https://github.com/containers/podman/releases/tag/v5.8.0
- Related: RHEL-122178

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 10	podman	7:5.8.2-1.0.1.el10_2
Oracle Linux · 10	podman-docker	7:5.8.2-1.0.1.el10_2
Oracle Linux · 10	podman-remote	7:5.8.2-1.0.1.el10_2
Oracle Linux · 10	podman-tests	7:5.8.2-1.0.1.el10_2

Vulnerabilities 2

High 7.5

CVE-2026-25679

Incorrect parsing of IPv6 host literals in net/url

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Go standard library net/url langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 6, 2026
High 7.5

CVE-2026-34986

Go JOSE affect by a panic in JWE decryption

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

go-jose go-jose zot kubescape Debian Ubuntu Alpine Wolfi Go

Apr 6, 2026