Skip to content
OpenAdvisories
High RHSA-2026:34192 5 CVEs

Red Hat Security Advisory: buildah security, bug fix, and enhancement update

Published Jul 2, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream buildah 2:1.33.15-1.el9_4.1
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream buildah-debuginfo 2:1.33.15-1.el9_4.1
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream buildah-debugsource 2:1.33.15-1.el9_4.1
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream buildah-tests 2:1.33.15-1.el9_4.1
Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream buildah-tests-debuginfo 2:1.33.15-1.el9_4.1

Vulnerabilities 5

  • High 7.5
    CVE-2026-32280

    Unexpected work during chain building in crypto/x509

    During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-32281

    Inefficient policy validation in crypto/x509

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-32283

    Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

    If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

    Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-33810

    Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

    When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issu…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-34986

    Go JOSE affect by a panic in JWE decryption

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

    go-jose go-jose zot kubescape Debian Ubuntu Alpine Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2455470
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2456333
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2456338
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2456339
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34192.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-32280
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-32280
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-32280
  • article
    https://go.dev/cl/758320
  • article
    https://go.dev/issue/78282
  • article
    https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
  • advisory
    https://pkg.go.dev/vuln/GO-2026-4947
  • report
    https://access.redhat.com/security/cve/CVE-2026-32281
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-32281
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-32281
  • article
    https://go.dev/cl/758061
  • article
    https://go.dev/issue/78281
  • advisory
    https://pkg.go.dev/vuln/GO-2026-4946
  • report
    https://access.redhat.com/security/cve/CVE-2026-32283
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-32283
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-32283
  • article
    https://go.dev/cl/763767
  • article
    https://go.dev/issue/78334
  • advisory
    https://pkg.go.dev/vuln/GO-2026-4870
  • report
    https://access.redhat.com/security/cve/CVE-2026-33810
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2456335
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33810
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33810
  • article
    https://go.dev/cl/763763
  • article
    https://go.dev/issue/78332
  • advisory
    https://pkg.go.dev/vuln/GO-2026-4866
  • report
    https://access.redhat.com/security/cve/CVE-2026-34986
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34986
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34986
  • article
    https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8
  • article
    https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants