Red Hat Security Advisory: podman security update

Fixed packages 8

Vulnerabilities 7

• High 7.5
  CVE-2026-33818

  Enforce maximum recursion depth in encoding/asn1

  Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

  Go standard library encoding/asn1 katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.5
  CVE-2026-56853

  Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

  When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.5
  CVE-2026-56859

  Add recursion depth guard during decode in encoding/xml

  Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

  Go standard library encoding/xml golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.5
  CVE-2026-56862

  Limit handshake messages we are willing to accept post-handshake in crypto/tls

  Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key deriva…

  Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.1
  CVE-2026-17106 Public exploit

  Tar extraction in moby/go-archive can write outside the destination directory via link following

  The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical str…

  Docker moby Docker Desktop Docker Sandboxes Debian Ubuntu Azure Linux Wolfi Go
  Aug 18, 2026
• Medium 6.1
  CVE-2026-56858

  Fix Javascript regexp context tracking in html/template

  Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

  Go standard library html/template katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• Medium 5.9
  CVE-2026-56860

  Avoid quadratic complexity in resolvePath in net/url

  Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte…

  Go standard library net/url katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515815
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515820
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515827
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515838
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515839
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515840
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2518147
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98554.json
• report
  https://access.redhat.com/security/cve/CVE-2026-17106
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-17106
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-17106
• article
  https://docs.docker.com/desktop/release-notes/#4860
• article
  https://docs.docker.com/engine/release-notes/29/#2970
• article
  https://github.com/docker/cli/releases/tag/v29.7.0
• article
  https://github.com/docker/compose/releases/tag/v5.4.0
• article
  https://github.com/docker/sbx-releases/releases/tag/v0.38.0
• article
  https://github.com/moby/go-archive/releases/tag/v0.3.0
• article
  https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h
• report
  https://access.redhat.com/security/cve/CVE-2026-33818
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33818
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33818
• article
  https://go.dev/cl/814980
• article
  https://go.dev/issue/80405
• article
  https://groups.google.com/g/golang-announce/c/94pEornpRlI
• advisory
  https://pkg.go.dev/vuln/GO-2026-5972
• report
  https://access.redhat.com/security/cve/CVE-2026-56853
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-56853
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-56853
• article
  https://go.dev/cl/795540
• article
  https://go.dev/issue/80205
• advisory
  https://pkg.go.dev/vuln/GO-2026-6089
• report
  https://access.redhat.com/security/cve/CVE-2026-56858
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-56858
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-56858
• article
  https://go.dev/cl/807100
• article
  https://go.dev/issue/80435
• advisory
  https://pkg.go.dev/vuln/GO-2026-6091
• report
  https://access.redhat.com/security/cve/CVE-2026-56859