RHSA-2026:51288 — Red Hat Security Advisory: container-tools:rhel8 security update

Fixed packages 134

Release	Package	Fixed in
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	aardvark-dns	2:1.0.1-40.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	buildah	1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	buildah-debuginfo	1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	buildah-debugsource	1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	buildah-tests	1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	buildah-tests-debuginfo	1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	cockpit-podman	0:49.1-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	conmon	2:2.1.4-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	conmon-debuginfo	2:2.1.4-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	conmon-debugsource	2:2.1.4-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	container-selinux	2:2.189.0-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	containernetworking-plugins	1:1.1.1-5.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	containernetworking-plugins-debuginfo	1:1.1.1-5.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	containernetworking-plugins-debugsource	1:1.1.1-5.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	containers-common	2:1-40.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	crit	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	criu	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	criu-debuginfo	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	criu-debugsource	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	criu-devel	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	criu-libs	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	criu-libs-debuginfo	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	crun	0:1.14.3-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	crun-debuginfo	0:1.14.3-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	crun-debugsource	0:1.14.3-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	fuse-overlayfs	0:1.9-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	fuse-overlayfs-debuginfo	0:1.9-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	fuse-overlayfs-debugsource	0:1.9-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	libslirp	0:4.4.0-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	libslirp-debuginfo	0:4.4.0-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	libslirp-debugsource	0:4.4.0-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	libslirp-devel	0:4.4.0-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	netavark	2:1.0.1-40.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	oci-seccomp-bpf-hook	0:1.2.6-1.module+el8.6.0+24215+d8cb7679.1
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	oci-seccomp-bpf-hook-debuginfo	0:1.2.6-1.module+el8.6.0+24215+d8cb7679.1
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	oci-seccomp-bpf-hook-debugsource	0:1.2.6-1.module+el8.6.0+24215+d8cb7679.1
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	podman	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	podman-catatonit	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	podman-catatonit-debuginfo	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	podman-debuginfo	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	podman-debugsource	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	podman-docker	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	podman-gvproxy	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	podman-gvproxy-debuginfo	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	podman-plugins	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	podman-plugins-debuginfo	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	podman-remote	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	podman-remote-debuginfo	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	podman-tests	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	python-podman	0:4.0.1-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	python3-criu	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	python3-podman	0:4.0.1-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	runc	1:1.2.9-1.module+el8.6.0+24505+50d764bf.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	runc-debuginfo	1:1.2.9-1.module+el8.6.0+24505+50d764bf.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	runc-debugsource	1:1.2.9-1.module+el8.6.0+24505+50d764bf.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	skopeo	2:1.9.5-1.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	skopeo-debuginfo	2:1.9.5-1.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	skopeo-debugsource	2:1.9.5-1.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	skopeo-tests	2:1.9.5-1.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	slirp4netns	0:1.2.0-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	slirp4netns-debuginfo	0:1.2.0-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	slirp4netns-debugsource	0:1.2.0-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	toolbox	0:0.0.99.3-0.7.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	toolbox-debuginfo	0:0.0.99.3-0.7.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	toolbox-debugsource	0:0.0.99.3-0.7.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	toolbox-tests	0:0.0.99.3-0.7.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	udica	0:0.2.6-5.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	aardvark-dns	2:1.0.1-40.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	buildah	1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	buildah-debuginfo	1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	buildah-debugsource	1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	buildah-tests	1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	buildah-tests-debuginfo	1:1.26.11-1.module+el8.6.0+24590+db5ff31b.3
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	cockpit-podman	0:49.1-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	conmon	2:2.1.4-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	conmon-debuginfo	2:2.1.4-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	conmon-debugsource	2:2.1.4-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	container-selinux	2:2.189.0-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	containernetworking-plugins	1:1.1.1-5.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	containernetworking-plugins-debuginfo	1:1.1.1-5.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	containernetworking-plugins-debugsource	1:1.1.1-5.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	containers-common	2:1-40.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	crit	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	criu	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	criu-debuginfo	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	criu-debugsource	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	criu-devel	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	criu-libs	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	criu-libs-debuginfo	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	crun	0:1.14.3-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	crun-debuginfo	0:1.14.3-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	crun-debugsource	0:1.14.3-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	fuse-overlayfs	0:1.9-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	fuse-overlayfs-debuginfo	0:1.9-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	fuse-overlayfs-debugsource	0:1.9-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	libslirp	0:4.4.0-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	libslirp-debuginfo	0:4.4.0-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	libslirp-debugsource	0:4.4.0-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	libslirp-devel	0:4.4.0-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	netavark	2:1.0.1-40.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	oci-seccomp-bpf-hook	0:1.2.6-1.module+el8.6.0+24215+d8cb7679.1
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	oci-seccomp-bpf-hook-debuginfo	0:1.2.6-1.module+el8.6.0+24215+d8cb7679.1
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	oci-seccomp-bpf-hook-debugsource	0:1.2.6-1.module+el8.6.0+24215+d8cb7679.1
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	podman	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	podman-catatonit	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	podman-catatonit-debuginfo	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	podman-debuginfo	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	podman-debugsource	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	podman-docker	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	podman-gvproxy	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	podman-gvproxy-debuginfo	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	podman-plugins	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	podman-plugins-debuginfo	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	podman-remote	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	podman-remote-debuginfo	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	podman-tests	2:4.2.0-8.module+el8.6.0+24590+db5ff31b.6
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	python-podman	0:4.0.1-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	python3-criu	0:3.15-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	python3-podman	0:4.0.1-1.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	runc	1:1.2.9-1.module+el8.6.0+24505+50d764bf.2
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	runc-debuginfo	1:1.2.9-1.module+el8.6.0+24505+50d764bf.2
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	runc-debugsource	1:1.2.9-1.module+el8.6.0+24505+50d764bf.2
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	skopeo	2:1.9.5-1.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	skopeo-debuginfo	2:1.9.5-1.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	skopeo-debugsource	2:1.9.5-1.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	skopeo-tests	2:1.9.5-1.module+el8.6.0+24590+db5ff31b.2
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	slirp4netns	0:1.2.0-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	slirp4netns-debuginfo	0:1.2.0-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	slirp4netns-debugsource	0:1.2.0-3.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	toolbox	0:0.0.99.3-0.7.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	toolbox-debuginfo	0:0.0.99.3-0.7.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	toolbox-debugsource	0:0.0.99.3-0.7.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	toolbox-tests	0:0.0.99.3-0.7.module+el8.6.0+24209+25a14987
Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::appstream	udica	0:0.2.6-5.module+el8.6.0+24209+25a14987

Vulnerabilities 10

Critical 9.1

CVE-2025-68121

Unexpected session resumption in crypto/tls

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user ca…

Go standard library crypto/tls langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 5, 2026
Critical 9.1

CVE-2026-42508

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts k3s k3s-static Debian Ubuntu Azure Linux Wolfi Go

May 22, 2026
High 7.5

CVE-2025-61726

Memory exhaustion in query parameter parsing in net/url

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encode…

Go standard library net/url katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Jan 28, 2026
High 7.5

CVE-2025-61729

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certi…

Go standard library crypto/x509 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Dec 2, 2025
High 7.5

CVE-2026-25679

Incorrect parsing of IPv6 host literals in net/url

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Go standard library net/url langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 6, 2026
High 7.5

CVE-2026-32280

Unexpected work during chain building in crypto/x509

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.5

CVE-2026-32281

Inefficient policy validation in crypto/x509

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…

Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.5

CVE-2026-32283

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
High 7.5

CVE-2026-33810

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issu…

Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 8, 2026
Medium 6.5

CVE-2025-61728

Excessive CPU consumption when building archive index in archive/zip

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

Go standard library archive/zip katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Jan 28, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2418462
report
https://bugzilla.redhat.com/show_bug.cgi?id=2434431
report
https://bugzilla.redhat.com/show_bug.cgi?id=2434432
report
https://bugzilla.redhat.com/show_bug.cgi?id=2437111
report
https://bugzilla.redhat.com/show_bug.cgi?id=2445356
report
https://bugzilla.redhat.com/show_bug.cgi?id=2456333
report
https://bugzilla.redhat.com/show_bug.cgi?id=2456338
report
https://bugzilla.redhat.com/show_bug.cgi?id=2456339
report
https://bugzilla.redhat.com/show_bug.cgi?id=2480688
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51288.json
report
https://access.redhat.com/security/cve/CVE-2025-61726
advisory
https://www.cve.org/CVERecord?id=CVE-2025-61726
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-61726
article
https://go.dev/cl/736712
article
https://go.dev/issue/77101
article
https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
advisory
https://pkg.go.dev/vuln/GO-2026-4341
report
https://access.redhat.com/security/cve/CVE-2025-61728
advisory
https://www.cve.org/CVERecord?id=CVE-2025-61728
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-61728
article
https://go.dev/cl/736713
article
https://go.dev/issue/77102
advisory
https://pkg.go.dev/vuln/GO-2026-4342
report
https://access.redhat.com/security/cve/CVE-2025-61729
advisory
https://www.cve.org/CVERecord?id=CVE-2025-61729
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-61729
article
https://go.dev/cl/725920
article
https://go.dev/issue/76445
article
https://groups.google.com/g/golang-announce/c/8FJoBkPddm4
advisory
https://pkg.go.dev/vuln/GO-2025-4155
report
https://access.redhat.com/security/cve/CVE-2025-68121
advisory
https://www.cve.org/CVERecord?id=CVE-2025-68121
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-68121
article
https://go.dev/cl/737700
article
https://go.dev/issue/77217
article
https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
advisory
https://pkg.go.dev/vuln/GO-2026-4337
report
https://access.redhat.com/security/cve/CVE-2026-25679

Red Hat Security Advisory: container-tools:rhel8 security update

Fixed packages 134

Vulnerabilities 10

Unexpected session resumption in crypto/tls

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

Memory exhaustion in query parameter parsing in net/url

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

Incorrect parsing of IPv6 host literals in net/url

Unexpected work during chain building in crypto/x509

Inefficient policy validation in crypto/x509

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Excessive CPU consumption when building archive index in archive/zip

References