Red Hat Security Advisory: podman security update

Fixed packages 8

Vulnerabilities 2

• High 7.5
  CVE-2026-25679

  Incorrect parsing of IPv6 host literals in net/url

  url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

  Go standard library net/url langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 6, 2026
• High 7.5
  CVE-2026-34986

  Go JOSE affect by a panic in JWE decryption

  Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

  go-jose go-jose zot kubescape Debian Ubuntu Alpine Wolfi Go
  Apr 6, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2445356
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2455470
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19017.json
• report
  https://access.redhat.com/security/cve/CVE-2026-25679
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-25679
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-25679
• article
  https://go.dev/cl/752180
• article
  https://go.dev/issue/77578
• article
  https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
• advisory
  https://pkg.go.dev/vuln/GO-2026-4601
• report
  https://access.redhat.com/security/cve/CVE-2026-34986
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-34986
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-34986
• article
  https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8
• article
  https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants