Summary
OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to use the Container Pod concept popularized by Kubernetes.
Security Fix(es):
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
Bug Fix(es) and Enhancement(s):
* oci-seccomp-bpf-hook - update to the latest upstream release (JIRA:Rocky Linux-212011)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | oci-seccomp-bpf-hook | 0:1.3.0-2.el10 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook | 0:1.3.0-2.el10 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook | 0:1.3.0-2.el10 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook | 0:1.3.0-2.el10 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debuginfo | 0:1.3.0-2.el10 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debuginfo | 0:1.3.0-2.el10 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debuginfo | 0:1.3.0-2.el10 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debuginfo | 0:1.3.0-2.el10 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debugsource | 0:1.3.0-2.el10 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debugsource | 0:1.3.0-2.el10 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debugsource | 0:1.3.0-2.el10 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debugsource | 0:1.3.0-2.el10 |
Vulnerabilities 1
-
High 7.5
Crash when handling long CNAME response in net
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.