Loading story…
Red Hat released multiple Important security updates for Podman across Red Hat Enterprise Linux 9 and 10 product streams after identifying vulnerabilities inherited from bundled or dependent Go components. The advisories cover RHEL 9, RHEL 9.4 support channels, RHEL 10.0 Extended Update Support, and RHEL 10, with fixed builds including podman-5.6.0-14.el9_7, podman-4.9.4-20.el9_4.2, podman-5.4.0-15.el10_0.1, and podman-5.8.2-1.el10_2 for x86_64, s390x, ppc64le, and aarch64 systems. Red Hat said the issues could lead to denial of service, excessive CPU consumption, memory exhaustion, incorrect URL or IPv6 host parsing, and improper TLS session resumption certificate validation.
One of the highlighted flaws, CVE-2026-34986, affects go-jose v3 and v4 and can cause a panic when a crafted JSON Web Encryption object is decrypted with certain key-wrapping algorithms and an empty encrypted_key field. Red Hat linked that bug to Podman updates for RHEL 10 streams alongside CVE-2026-25679, an IPv6 host literal parsing issue in Go's net/url package, while earlier Podman advisories addressed related Go vulnerabilities such as CVE-2025-61729, CVE-2025-61728, CVE-2025-61726, and CVE-2025-68121. The fixes align with upstream go-jose releases 3.0.5 and 4.1.4, which remediate the JWE-triggered denial-of-service condition.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-19, Red Hat published advisory RHSA-2026:19017 for podman on Red Hat Enterprise Linux 10. The Important update released podman 5.8.2-1.el10_2 and fixed CVE-2026-25679 and CVE-2026-34986.
On 2026-05-13, Red Hat published advisory RHSA-2026:17040 for podman on Red Hat Enterprise Linux 10.0 Extended Update Support. The Important update released podman 5.4.0-15.el10_0.1 and fixed multiple Go-related flaws including CVE-2026-34986 and CVE-2026-25679.
On 2026-04-30, Red Hat published advisory RHSA-2026:12028 for podman on Red Hat Enterprise Linux 9.4 Extended Update Support. The Important update released podman 4.9.4-20.el9_4.2 and fixed CVE-2025-61729, CVE-2025-61728, CVE-2025-61726, CVE-2025-68121, and CVE-2026-25679.
On 2026-04-24, Red Hat Bugzilla documented CVE-2026-34986 affecting go-jose v3 and v4, where a crafted JWE object can trigger a panic and denial of service. The entry states the issue was fixed upstream in Go JOSE versions 4.1.4 and 3.0.5.
On 2026-04-13, Red Hat published advisory RHSA-2026:7854 for podman on Red Hat Enterprise Linux 9.6 Extended Update Support and related RHEL 9.6 channels. The Important update released podman 5.4.0-20.el9_6.2 and fixed CVE-2025-61729, CVE-2025-61728, CVE-2025-61726, and CVE-2025-68121 in bundled Go components.
On 2026-02-25, Red Hat published advisory RHSA-2026:3336 for podman on Red Hat Enterprise Linux 10. The Important update released podman 5.6.0-12.el10_1 and fixed CVE-2025-61729, CVE-2025-61728, CVE-2025-61726, and CVE-2025-68121 in bundled Go components.
On 2026-02-25, Red Hat published advisory RHSA-2026:3337 for podman on Red Hat Enterprise Linux 9. The Important update released podman 5.6.0-14.el9_7 and fixed CVE-2025-61729, CVE-2025-61728, CVE-2025-61726, and CVE-2025-68121 in bundled Go components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat has issued a broad set of **Important** security advisories for container-focused packages including **podman**, **buildah**, **skopeo**, **runc**, and **containernetworking-plugins** across RHEL 8, 9, and 10, fixing denial-of-service flaws inherited from Go libraries. The recurring issues include `CVE-2026-32280`, `CVE-2026-32281`, and `CVE-2026-32283`, which affect certificate chain building and validation in `crypto/x509` and TLS 1.3 key update handling in `crypto/tls`; several advisories also include `CVE-2026-25679` in `net/url` and `CVE-2026-34986` in `go-jose`. Updated packages were released for multiple architectures and support channels, including standard, SAP, AUS, EUS, and Extended Life Cycle variants. The updates follow earlier tracking of Go certificate-processing weaknesses, including `CVE-2025-61729`, a high-severity `crypto/x509` denial-of-service bug in `HostnameError.Error()` that can be triggered by a crafted certificate to drive excessive CPU and memory consumption through unbounded host printing and quadratic string concatenation. Red Hat’s bug record linked that flaw to remediation across a wide range of products beyond container tooling, including Red Hat Enterprise Linux 7 through 10, OpenShift, Ansible Automation Platform, Ceph Storage, Satellite, OpenStack offerings, Cryostat, and Streams for Apache Kafka, underscoring the broad downstream impact of Go security defects on enterprise platforms.
Sep 4, 2026
Red Hat disclosed and patched **CVE-2026-39822**, an Important vulnerability in Go's `os.Root` handling on Unix systems that can improperly follow a symbolic link outside the intended root boundary, enabling directory traversal. The flaw is triggered when the final path component is a symlink and the supplied path ends with a trailing slash, such as `root.Open("symlink/")`, and Red Hat said fixes were prepared across multiple Red Hat Enterprise Linux releases, including **RHEL 8, RHEL 9, RHEL 10**, and Extended Update Support variants. Red Hat published July advisories covering affected container tooling, including **RHSA-2026:38878** for **podman** on RHEL 9 and **RHSA-2026:38493** and **RHSA-2026:38494** for **buildah** on RHEL 9 and RHEL 10. The updates deliver patched packages including **podman `5.8.2-5.el9_8`** and **buildah `1.43.1-4.el9_8`** and `1.43.1-4.el10_2`, with fixes released for multiple architectures and support channels such as x86_64, s390x, ppc64le, and aarch64.
Aug 26, 2026
Red Hat released multiple **Important** security advisories for `containernetworking-plugins`, `skopeo`, and `git-lfs` across RHEL 9 and RHEL 10 channels after upstream Go vulnerabilities exposed those packages to denial-of-service, memory exhaustion, and TLS validation risks. The updates address `CVE-2025-61729` in Go's `crypto/x509`, `CVE-2025-61726` in `net/url` query parsing, and `CVE-2025-68121` in `crypto/tls`; newer `containernetworking-plugins` advisories also include `CVE-2026-25679`, an IPv6 host literal parsing flaw in `net/url`. Affected product streams include RHEL 9, RHEL 9.2 SAP-related channels, RHEL 9.6 EUS and associated service variants, and RHEL 10 update channels on `x86_64`, `aarch64`, `ppc64le`, and `s390x`. Upstream Go disclosures show the most prominent issue, `CVE-2025-61729`, can drive excessive CPU use during certificate hostname verification through inefficient handling in `crypto/x509`, including repeated hostname splitting and costly string processing in verification paths such as `Certificate.Verify` and `VerifyHostname`. Red Hat shipped fixed builds including `containernetworking-plugins` `1.7.1-3.el9_7`, `1.6.2-3.el9_6`, and `1.2.0-3.el9_2.3`, `skopeo` `1.20.0-3.el10_1`, and `git-lfs` `3.6.1-2.el10_0.2`, and urged customers to apply the updates to reduce exposure in container networking and software supply chain workflows.
Aug 20, 2026