Loading story…
Red Hat released multiple security advisories for RHEL 8.8 and RHEL 9 container tooling to remediate vulnerabilities in runc, buildah, podman, skopeo, and related packages. The most serious issues were three runc flaws—CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881—that can enable container escape or denial of service through masked path abuse, /dev/console mount race conditions, and arbitrary write gadgets using procfs write redirects. Red Hat rated several of the updates Important, including advisories affecting RHEL 9.0 SAP Solutions, RHEL 9.2 channels, RHEL 9.4 channels, and broader RHEL 9 package streams.
The updates also addressed additional bundled-component flaws, including CVE-2025-58183 in Go's archive/tar package, which can trigger unbounded memory allocation when parsing a GNU sparse map; CVE-2025-47913 in golang.org/x/crypto/ssh/agent, which can cause a panic; and CVE-2025-65637 in github.com/sirupsen/logrus, a denial-of-service issue. Fixed package versions published across the advisories include runc 1.2.9-1.el9_2.1, buildah 1.29.5-1.el9_2.2, buildah 1.33.13-2.el9_4.1, buildah 1.41.6-1.el9_7, and updated RHEL 9.0 SAP Solutions builds for buildah, crun, podman, runc, and skopeo; Red Hat also shipped a Moderate update for the container-tools:rhel8 module to fix the Go archive/tar and logrus issues.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-15, Red Hat published Important advisory RHSA-2026:8325 for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. The advisory updates buildah, crun, podman, runc, and skopeo to fix runc container escape flaws CVE-2025-31133, CVE-2025-52565, CVE-2025-52881, plus CVE-2025-58183, CVE-2025-47913, and CVE-2025-65637.
On 2026-03-30, Red Hat published Moderate advisory RHSA-2026:6191 for the container-tools:rhel8 module in RHEL 8.8 update channels. The update remediates CVE-2025-58183 and CVE-2025-65637 and ships updated container-related packages including podman, buildah, skopeo, and runc.
On 2026-03-12, Red Hat published Important advisory RHSA-2026:4532 for buildah in RHEL 9.2 channels. The update provides buildah 1.29.5-1.el9_2.2 and addresses CVE-2025-52881, CVE-2025-58183, CVE-2025-47913, and CVE-2025-65637.
On 2026-03-12, Red Hat published Important advisory RHSA-2026:4531 for runc in RHEL 9.2 channels. The update provides runc 1.2.9-1.el9_2.1 and fixes container escape flaws CVE-2025-31133, CVE-2025-52565, CVE-2025-52881, plus logrus DoS issue CVE-2025-65637.
On 2026-01-12, Red Hat published Important advisory RHSA-2026:0426 for buildah in RHEL 9.4 streams, including Extended Update Support, SAP Solutions, and Extended Life Cycle variants. The update delivers buildah 1.33.13-2.el9_4.1 and addresses CVE-2025-52881 and CVE-2025-58183.
On 2025-11-25, Red Hat published Important advisory RHSA-2025:22011 for buildah on Red Hat Enterprise Linux 9. The update provides buildah 1.41.6-1.el9_7 and fixes CVE-2025-52881 and CVE-2025-58183 across multiple RHEL 9 variants and architectures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a broad set of **Important** security updates for RHEL, OpenShift Container Platform, and container tooling to fix three `runc` vulnerabilities that can enable container escape: `CVE-2025-31133`, `CVE-2025-52565`, and `CVE-2025-52881`. The flaws affect `runc` directly and propagate into packages and platforms built around it, including **podman**, **buildah**, **skopeo**, and OpenShift releases spanning 4.12 through 4.18, as well as RHEL 8, RHEL 9, and selected RHEL 10 channels. Red Hat also shipped related fixes in some advisories for additional bundled issues such as `CVE-2025-58183` in Go `archive/tar`, `CVE-2025-65637` in `logrus`, and `CVE-2025-22871` in Go `net/http`. Bug records describe `CVE-2025-31133` as a masked-path mount race that can abuse `/dev/null`, `CVE-2025-52565` as a `/dev/console` bind-mount race involving symlink replacement, and `CVE-2025-52881` as a higher-severity `opencontainers/selinux` flaw that can cause **container escape and denial of service** through arbitrary write gadgets and procfs write redirects. Red Hat said the issues were addressed through updated `runc` and container-stack packages, including releases such as `runc 1.2.9-1.el9_4`, `runc 1.2.5-3.el9_6`, `runc 1.3.0-4.el9_7`, and updated OpenShift builds and images, and urged customers to upgrade affected systems through standard RHEL update channels or OpenShift release channels.
Aug 20, 2026
Red Hat has issued a broad set of **Important** security advisories for container-focused packages including **podman**, **buildah**, **skopeo**, **runc**, and **containernetworking-plugins** across RHEL 8, 9, and 10, fixing denial-of-service flaws inherited from Go libraries. The recurring issues include `CVE-2026-32280`, `CVE-2026-32281`, and `CVE-2026-32283`, which affect certificate chain building and validation in `crypto/x509` and TLS 1.3 key update handling in `crypto/tls`; several advisories also include `CVE-2026-25679` in `net/url` and `CVE-2026-34986` in `go-jose`. Updated packages were released for multiple architectures and support channels, including standard, SAP, AUS, EUS, and Extended Life Cycle variants. The updates follow earlier tracking of Go certificate-processing weaknesses, including `CVE-2025-61729`, a high-severity `crypto/x509` denial-of-service bug in `HostnameError.Error()` that can be triggered by a crafted certificate to drive excessive CPU and memory consumption through unbounded host printing and quadratic string concatenation. Red Hat’s bug record linked that flaw to remediation across a wide range of products beyond container tooling, including Red Hat Enterprise Linux 7 through 10, OpenShift, Ansible Automation Platform, Ceph Storage, Satellite, OpenStack offerings, Cryostat, and Streams for Apache Kafka, underscoring the broad downstream impact of Go security defects on enterprise platforms.
Sep 4, 2026
Red Hat disclosed and patched **CVE-2026-39822**, an Important vulnerability in Go's `os.Root` handling on Unix systems that can improperly follow a symbolic link outside the intended root boundary, enabling directory traversal. The flaw is triggered when the final path component is a symlink and the supplied path ends with a trailing slash, such as `root.Open("symlink/")`, and Red Hat said fixes were prepared across multiple Red Hat Enterprise Linux releases, including **RHEL 8, RHEL 9, RHEL 10**, and Extended Update Support variants. Red Hat published July advisories covering affected container tooling, including **RHSA-2026:38878** for **podman** on RHEL 9 and **RHSA-2026:38493** and **RHSA-2026:38494** for **buildah** on RHEL 9 and RHEL 10. The updates deliver patched packages including **podman `5.8.2-5.el9_8`** and **buildah `1.43.1-4.el9_8`** and `1.43.1-4.el10_2`, with fixes released for multiple architectures and support channels such as x86_64, s390x, ppc64le, and aarch64.
Aug 26, 2026