RHSA-2026:49944 — Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

Fixed packages 130

Release	Package	Fixed in
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	aardvark-dns	2:1.5.0-2.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	buildah	1:1.29.8-1.module+el8.8.0+24545+b713e821
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	buildah-debuginfo	1:1.29.8-1.module+el8.8.0+24545+b713e821
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	buildah-debugsource	1:1.29.8-1.module+el8.8.0+24545+b713e821
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	buildah-tests	1:1.29.8-1.module+el8.8.0+24545+b713e821
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	buildah-tests-debuginfo	1:1.29.8-1.module+el8.8.0+24545+b713e821
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	cockpit-podman	0:63.1-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	conmon	3:2.1.6-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	conmon-debuginfo	3:2.1.6-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	conmon-debugsource	3:2.1.6-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	container-selinux	2:2.229.0-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	containernetworking-plugins	1:1.2.0-3.module+el8.8.0+24525+a924b82f.1
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	containernetworking-plugins-debuginfo	1:1.2.0-3.module+el8.8.0+24525+a924b82f.1
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	containernetworking-plugins-debugsource	1:1.2.0-3.module+el8.8.0+24525+a924b82f.1
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	containers-common	2:1-67.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	crit	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	criu	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	criu-debuginfo	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	criu-debugsource	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	criu-devel	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	criu-libs	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	criu-libs-debuginfo	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	crun	0:1.14.3-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	crun-debuginfo	0:1.14.3-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	crun-debugsource	0:1.14.3-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	fuse-overlayfs	0:1.11-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	fuse-overlayfs-debuginfo	0:1.11-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	fuse-overlayfs-debugsource	0:1.11-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	libslirp	0:4.4.0-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	libslirp-debuginfo	0:4.4.0-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	libslirp-debugsource	0:4.4.0-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	libslirp-devel	0:4.4.0-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	netavark	2:1.5.1-3.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.8.0+24130+2fde7a57
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	oci-seccomp-bpf-hook-debuginfo	0:1.2.10-1.module+el8.8.0+24130+2fde7a57
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	oci-seccomp-bpf-hook-debugsource	0:1.2.10-1.module+el8.8.0+24130+2fde7a57
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	podman	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	podman-catatonit	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	podman-catatonit-debuginfo	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	podman-debuginfo	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	podman-debugsource	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	podman-docker	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	podman-gvproxy	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	podman-gvproxy-debuginfo	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	podman-plugins	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	podman-plugins-debuginfo	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	podman-remote	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	podman-remote-debuginfo	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	podman-tests	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	python-podman	0:4.4.1-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	python3-criu	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	python3-podman	0:4.4.1-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	runc	1:1.2.9-1.module+el8.8.0+24525+a924b82f.1
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	runc-debuginfo	1:1.2.9-1.module+el8.8.0+24525+a924b82f.1
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	runc-debugsource	1:1.2.9-1.module+el8.8.0+24525+a924b82f.1
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	skopeo	2:1.11.6-1.module+el8.8.0+24525+a924b82f
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	skopeo-tests	2:1.11.6-1.module+el8.8.0+24525+a924b82f
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	slirp4netns	0:1.2.0-3.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	slirp4netns-debuginfo	0:1.2.0-3.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	slirp4netns-debugsource	0:1.2.0-3.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	toolbox	0:0.0.99.3-7.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	toolbox-debuginfo	0:0.0.99.3-7.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	toolbox-debugsource	0:0.0.99.3-7.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	toolbox-tests	0:0.0.99.3-7.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 E4S rhel_e4s:8.8::appstream	udica	0:0.2.6-20.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	aardvark-dns	2:1.5.0-2.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	buildah	1:1.29.8-1.module+el8.8.0+24545+b713e821
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	buildah-debuginfo	1:1.29.8-1.module+el8.8.0+24545+b713e821
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	buildah-debugsource	1:1.29.8-1.module+el8.8.0+24545+b713e821
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	buildah-tests	1:1.29.8-1.module+el8.8.0+24545+b713e821
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	buildah-tests-debuginfo	1:1.29.8-1.module+el8.8.0+24545+b713e821
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	cockpit-podman	0:63.1-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	conmon	3:2.1.6-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	conmon-debuginfo	3:2.1.6-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	conmon-debugsource	3:2.1.6-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	container-selinux	2:2.229.0-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	containernetworking-plugins	1:1.2.0-3.module+el8.8.0+24525+a924b82f.1
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	containernetworking-plugins-debuginfo	1:1.2.0-3.module+el8.8.0+24525+a924b82f.1
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	containernetworking-plugins-debugsource	1:1.2.0-3.module+el8.8.0+24525+a924b82f.1
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	containers-common	2:1-67.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	crit	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	criu	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	criu-debuginfo	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	criu-debugsource	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	criu-devel	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	criu-libs	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	criu-libs-debuginfo	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	crun	0:1.14.3-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	crun-debuginfo	0:1.14.3-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	crun-debugsource	0:1.14.3-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	fuse-overlayfs	0:1.11-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	fuse-overlayfs-debuginfo	0:1.11-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	fuse-overlayfs-debugsource	0:1.11-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	libslirp	0:4.4.0-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	libslirp-debuginfo	0:4.4.0-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	libslirp-debugsource	0:4.4.0-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	libslirp-devel	0:4.4.0-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	netavark	2:1.5.1-3.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.8.0+24130+2fde7a57
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	oci-seccomp-bpf-hook-debuginfo	0:1.2.10-1.module+el8.8.0+24130+2fde7a57
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	oci-seccomp-bpf-hook-debugsource	0:1.2.10-1.module+el8.8.0+24130+2fde7a57
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	podman	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	podman-catatonit	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	podman-catatonit-debuginfo	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	podman-debuginfo	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	podman-debugsource	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	podman-docker	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	podman-gvproxy	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	podman-gvproxy-debuginfo	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	podman-plugins	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	podman-plugins-debuginfo	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	podman-remote	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	podman-remote-debuginfo	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	podman-tests	3:4.4.1-27.module+el8.8.0+24545+b713e821.8
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	python-podman	0:4.4.1-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	python3-criu	0:3.15-4.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	python3-podman	0:4.4.1-1.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	runc	1:1.2.9-1.module+el8.8.0+24525+a924b82f.1
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	runc-debuginfo	1:1.2.9-1.module+el8.8.0+24525+a924b82f.1
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	runc-debugsource	1:1.2.9-1.module+el8.8.0+24525+a924b82f.1
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	skopeo	2:1.11.6-1.module+el8.8.0+24525+a924b82f
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	skopeo-tests	2:1.11.6-1.module+el8.8.0+24525+a924b82f
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	slirp4netns	0:1.2.0-3.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	slirp4netns-debuginfo	0:1.2.0-3.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	slirp4netns-debugsource	0:1.2.0-3.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	toolbox	0:0.0.99.3-7.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	toolbox-debuginfo	0:0.0.99.3-7.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	toolbox-debugsource	0:0.0.99.3-7.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	toolbox-tests	0:0.0.99.3-7.module+el8.8.0+23884+2031fc78
Red Hat · RHEL 8.8 TUS rhel_tus:8.8::appstream	udica	0:0.2.6-20.module+el8.8.0+23884+2031fc78

Vulnerabilities 13

Critical 9.1

CVE-2025-68121

Unexpected session resumption in crypto/tls

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user ca…

Go standard library crypto/tls langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 5, 2026
Critical 9.1

CVE-2026-39830

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited glob…

golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go

May 22, 2026
Critical 9.1

CVE-2026-39832

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote…

golang.org/x/crypto golang.org/x/crypto/ssh/agent zot kubescape Debian Ubuntu Azure Linux Wolfi Go

May 22, 2026
Critical 9.1

CVE-2026-42508

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts k3s k3s-static Debian Ubuntu Azure Linux Wolfi Go

May 22, 2026
High 7.5

CVE-2025-61726

Memory exhaustion in query parameter parsing in net/url

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encode…

Go standard library net/url katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Jan 28, 2026
High 7.5

CVE-2025-61729

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certi…

Go standard library crypto/x509 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Dec 2, 2025
High 7.5

CVE-2026-25679

Incorrect parsing of IPv6 host literals in net/url

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Go standard library net/url langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 6, 2026
High 7.5

CVE-2026-32280

Unexpected work during chain building in crypto/x509

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.5

CVE-2026-32281

Inefficient policy validation in crypto/x509

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…

Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.5

CVE-2026-32283

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.5

CVE-2026-34986

Go JOSE affect by a panic in JWE decryption

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

go-jose go-jose zot kubescape Debian Ubuntu Alpine Wolfi Go

Apr 6, 2026
High 7.5

CVE-2026-39829

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by …

golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go

May 22, 2026
Medium 6.5

CVE-2025-61728

Excessive CPU consumption when building archive index in archive/zip

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

Go standard library archive/zip katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Jan 28, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2418462
report
https://bugzilla.redhat.com/show_bug.cgi?id=2434431
report
https://bugzilla.redhat.com/show_bug.cgi?id=2434432
report
https://bugzilla.redhat.com/show_bug.cgi?id=2437111
report
https://bugzilla.redhat.com/show_bug.cgi?id=2445356
report
https://bugzilla.redhat.com/show_bug.cgi?id=2455470
report
https://bugzilla.redhat.com/show_bug.cgi?id=2456333
report
https://bugzilla.redhat.com/show_bug.cgi?id=2456338
report
https://bugzilla.redhat.com/show_bug.cgi?id=2456339
report
https://bugzilla.redhat.com/show_bug.cgi?id=2480681
report
https://bugzilla.redhat.com/show_bug.cgi?id=2480684
report
https://bugzilla.redhat.com/show_bug.cgi?id=2480685
report
https://bugzilla.redhat.com/show_bug.cgi?id=2480688
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49944.json
report
https://access.redhat.com/security/cve/CVE-2025-61726
advisory
https://www.cve.org/CVERecord?id=CVE-2025-61726
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-61726
article
https://go.dev/cl/736712
article
https://go.dev/issue/77101
article
https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
advisory
https://pkg.go.dev/vuln/GO-2026-4341
report
https://access.redhat.com/security/cve/CVE-2025-61728
advisory
https://www.cve.org/CVERecord?id=CVE-2025-61728
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-61728
article
https://go.dev/cl/736713
article
https://go.dev/issue/77102
advisory
https://pkg.go.dev/vuln/GO-2026-4342
report
https://access.redhat.com/security/cve/CVE-2025-61729
advisory
https://www.cve.org/CVERecord?id=CVE-2025-61729
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-61729
article
https://go.dev/cl/725920
article
https://go.dev/issue/76445
article
https://groups.google.com/g/golang-announce/c/8FJoBkPddm4
advisory
https://pkg.go.dev/vuln/GO-2025-4155
report
https://access.redhat.com/security/cve/CVE-2025-68121
advisory
https://www.cve.org/CVERecord?id=CVE-2025-68121
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-68121
article
https://go.dev/cl/737700

Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

Fixed packages 130

Vulnerabilities 13

Unexpected session resumption in crypto/tls

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Memory exhaustion in query parameter parsing in net/url

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

Incorrect parsing of IPv6 host literals in net/url

Unexpected work during chain building in crypto/x509

Inefficient policy validation in crypto/x509

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Go JOSE affect by a panic in JWE decryption

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Excessive CPU consumption when building archive index in archive/zip

References