RHSA-2026:33722 — Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

Fixed packages 41

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	aardvark-dns	2:1.10.1-2.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah	2:1.33.14-3.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-debuginfo	2:1.33.14-3.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-debugsource	2:1.33.14-3.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-tests	2:1.33.14-3.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-tests-debuginfo	2:1.33.14-3.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	cockpit-podman	0:84.1-1.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	conmon	3:2.1.10-1.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	container-selinux	2:2.229.0-3.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins	1:1.4.0-8.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins-debuginfo	1:1.4.0-8.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins-debugsource	1:1.4.0-8.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	containers-common	2:1-82.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu	0:3.18-5.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	crun	0:1.14.3-2.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	fuse-overlayfs	0:1.13-1.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp	0:4.4.0-2.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	netavark	2:1.10.3-1.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman	4:4.9.4-31.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-catatonit	4:4.9.4-31.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-catatonit-debuginfo	4:4.9.4-31.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-debuginfo	4:4.9.4-31.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-debugsource	4:4.9.4-31.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-docker	4:4.9.4-31.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-gvproxy	4:4.9.4-31.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-gvproxy-debuginfo	4:4.9.4-31.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-plugins	4:4.9.4-31.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-plugins-debuginfo	4:4.9.4-31.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-remote	4:4.9.4-31.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-remote-debuginfo	4:4.9.4-31.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-tests	4:4.9.4-31.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-podman	0:4.9.0-3.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc	4:1.2.9-4.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc-debuginfo	4:1.2.9-4.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc-debugsource	4:1.2.9-4.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo	2:1.14.6-2.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo-tests	2:1.14.6-2.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	slirp4netns	0:1.2.3-1.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox	0:0.0.99.5.1-1.module+el8.10.0+24321+617e8352
Red Hat · RHEL 8 enterprise_linux:8::appstream	udica	0:0.2.6-21.module+el8.10.0+24321+617e8352

Vulnerabilities 5

High 7.5

CVE-2026-25679

Incorrect parsing of IPv6 host literals in net/url

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Go standard library net/url langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 6, 2026
High 7.5

CVE-2026-32280

Unexpected work during chain building in crypto/x509

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.5

CVE-2026-32281

Inefficient policy validation in crypto/x509

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…

Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.5

CVE-2026-32283

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.5

CVE-2026-34986

Go JOSE affect by a panic in JWE decryption

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

go-jose go-jose zot kubescape Debian Ubuntu Alpine Wolfi Go

Apr 6, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2445356
report
https://bugzilla.redhat.com/show_bug.cgi?id=2455470
report
https://bugzilla.redhat.com/show_bug.cgi?id=2456333
report
https://bugzilla.redhat.com/show_bug.cgi?id=2456338
report
https://bugzilla.redhat.com/show_bug.cgi?id=2456339
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33722.json
report
https://access.redhat.com/security/cve/CVE-2026-25679
advisory
https://www.cve.org/CVERecord?id=CVE-2026-25679
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-25679
article
https://go.dev/cl/752180
article
https://go.dev/issue/77578
article
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
advisory
https://pkg.go.dev/vuln/GO-2026-4601
report
https://access.redhat.com/security/cve/CVE-2026-32280
advisory
https://www.cve.org/CVERecord?id=CVE-2026-32280
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32280
article
https://go.dev/cl/758320
article
https://go.dev/issue/78282
article
https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
advisory
https://pkg.go.dev/vuln/GO-2026-4947
report
https://access.redhat.com/security/cve/CVE-2026-32281
advisory
https://www.cve.org/CVERecord?id=CVE-2026-32281
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32281
article
https://go.dev/cl/758061
article
https://go.dev/issue/78281
advisory
https://pkg.go.dev/vuln/GO-2026-4946
report
https://access.redhat.com/security/cve/CVE-2026-32283
advisory
https://www.cve.org/CVERecord?id=CVE-2026-32283
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32283
article
https://go.dev/cl/763767
article
https://go.dev/issue/78334
advisory
https://pkg.go.dev/vuln/GO-2026-4870
report
https://access.redhat.com/security/cve/CVE-2026-34986
advisory
https://www.cve.org/CVERecord?id=CVE-2026-34986
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34986
article
https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8
article
https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants

Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

Fixed packages 41

Vulnerabilities 5

Incorrect parsing of IPv6 host literals in net/url

Unexpected work during chain building in crypto/x509

Inefficient policy validation in crypto/x509

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Go JOSE affect by a panic in JWE decryption

References