Skip to content
OpenAdvisories
High RLSA-2026:19186 1 CVE

Important: buildah security update

Published May 28, 2026 · Updated May 28, 2026

Ecosystem: Rocky Linux

Summary

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 buildah 2:1.43.1-1.el9_8

Vulnerabilities 1

  • High 7.5
    CVE-2026-34986

    Go JOSE affect by a panic in JWE decryption

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

    go-jose go-jose zot kubescape Debian Ubuntu Alpine Wolfi Go

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2455470