{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for podman is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.\n\nSecurity Fix(es):\n\n* podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)\n\n* podman: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n\n* podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n\n* podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n\n* podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)\n\n* podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n\n* podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n\n* podman: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)\n\n* podman: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)\n\n* podman: Quadlet install --replace non-truncating write retains removed host-access directives (CVE-2026-19730)\n\n* podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2026:70201", "url": "https://access.redhat.com/errata/RHSA-2026:70201" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2456335", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335" }, { "category": "external", "summary": "2467809", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809" }, { "category": "external", "summary": "2504233", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233" }, { "category": "external", "summary": "2508234", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508234" }, { "category": "external", "summary": "2515815", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "category": "external", "summary": "2515820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "category": "external", "summary": "2515827", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "category": "external", "summary": "2515838", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "category": "external", "summary": "2515839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "category": "external", "summary": "2515840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70201.json" } ], "title": "Red Hat Security Advisory: podman security update", "tracking": { "current_release_date": "2026-09-23T05:20:06+00:00", "generator": { "date": "2026-09-23T05:20:06+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.4.0" } }, "id": "RHSA-2026:70201", "initial_release_date": "2026-09-22T14:19:35+00:00", "revision_history": [ { "date": "2026-09-22T14:19:35+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-09-22T14:19:35+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2026-09-23T05:20:06+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 10)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:10.2" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product": { "name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:10.2" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "podman-7:5.8.2-9.el10_2.src", "product": { "name": "podman-7:5.8.2-9.el10_2.src", "product_id": "podman-7:5.8.2-9.el10_2.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman@5.8.2-9.el10_2?arch=src&epoch=7" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "podman-7:5.8.2-9.el10_2.aarch64", "product": { "name": "podman-7:5.8.2-9.el10_2.aarch64", "product_id": "podman-7:5.8.2-9.el10_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman@5.8.2-9.el10_2?arch=aarch64&epoch=7" } } }, { "category": "product_version", "name": "podman-remote-7:5.8.2-9.el10_2.aarch64", "product": { "name": "podman-remote-7:5.8.2-9.el10_2.aarch64", "product_id": "podman-remote-7:5.8.2-9.el10_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote@5.8.2-9.el10_2?arch=aarch64&epoch=7" } } }, { "category": "product_version", "name": "podman-debugsource-7:5.8.2-9.el10_2.aarch64", "product": { "name": "podman-debugsource-7:5.8.2-9.el10_2.aarch64", "product_id": "podman-debugsource-7:5.8.2-9.el10_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debugsource@5.8.2-9.el10_2?arch=aarch64&epoch=7" } } }, { "category": "product_version", "name": "podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "product": { "name": "podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "product_id": "podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debuginfo@5.8.2-9.el10_2?arch=aarch64&epoch=7" } } }, { "category": "product_version", "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "product": { "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "product_id": "podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote-debuginfo@5.8.2-9.el10_2?arch=aarch64&epoch=7" } } }, { "category": "product_version", "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "product": { "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "product_id": "podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests-debuginfo@5.8.2-9.el10_2?arch=aarch64&epoch=7" } } }, { "category": "product_version", "name": "podman-tests-7:5.8.2-9.el10_2.aarch64", "product": { "name": "podman-tests-7:5.8.2-9.el10_2.aarch64", "product_id": "podman-tests-7:5.8.2-9.el10_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests@5.8.2-9.el10_2?arch=aarch64&epoch=7" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "podman-7:5.8.2-9.el10_2.ppc64le", "product": { "name": "podman-7:5.8.2-9.el10_2.ppc64le", "product_id": "podman-7:5.8.2-9.el10_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman@5.8.2-9.el10_2?arch=ppc64le&epoch=7" } } }, { "category": "product_version", "name": "podman-remote-7:5.8.2-9.el10_2.ppc64le", "product": { "name": "podman-remote-7:5.8.2-9.el10_2.ppc64le", "product_id": "podman-remote-7:5.8.2-9.el10_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote@5.8.2-9.el10_2?arch=ppc64le&epoch=7" } } }, { "category": "product_version", "name": "podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "product": { "name": "podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "product_id": "podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debugsource@5.8.2-9.el10_2?arch=ppc64le&epoch=7" } } }, { "category": "product_version", "name": "podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "product": { "name": "podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "product_id": "podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debuginfo@5.8.2-9.el10_2?arch=ppc64le&epoch=7" } } }, { "category": "product_version", "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "product": { "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "product_id": "podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote-debuginfo@5.8.2-9.el10_2?arch=ppc64le&epoch=7" } } }, { "category": "product_version", "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "product": { "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "product_id": "podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests-debuginfo@5.8.2-9.el10_2?arch=ppc64le&epoch=7" } } }, { "category": "product_version", "name": "podman-tests-7:5.8.2-9.el10_2.ppc64le", "product": { "name": "podman-tests-7:5.8.2-9.el10_2.ppc64le", "product_id": "podman-tests-7:5.8.2-9.el10_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests@5.8.2-9.el10_2?arch=ppc64le&epoch=7" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "podman-7:5.8.2-9.el10_2.s390x", "product": { "name": "podman-7:5.8.2-9.el10_2.s390x", "product_id": "podman-7:5.8.2-9.el10_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman@5.8.2-9.el10_2?arch=s390x&epoch=7" } } }, { "category": "product_version", "name": "podman-remote-7:5.8.2-9.el10_2.s390x", "product": { "name": "podman-remote-7:5.8.2-9.el10_2.s390x", "product_id": "podman-remote-7:5.8.2-9.el10_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote@5.8.2-9.el10_2?arch=s390x&epoch=7" } } }, { "category": "product_version", "name": "podman-debugsource-7:5.8.2-9.el10_2.s390x", "product": { "name": "podman-debugsource-7:5.8.2-9.el10_2.s390x", "product_id": "podman-debugsource-7:5.8.2-9.el10_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debugsource@5.8.2-9.el10_2?arch=s390x&epoch=7" } } }, { "category": "product_version", "name": "podman-debuginfo-7:5.8.2-9.el10_2.s390x", "product": { "name": "podman-debuginfo-7:5.8.2-9.el10_2.s390x", "product_id": "podman-debuginfo-7:5.8.2-9.el10_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debuginfo@5.8.2-9.el10_2?arch=s390x&epoch=7" } } }, { "category": "product_version", "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "product": { "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "product_id": "podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote-debuginfo@5.8.2-9.el10_2?arch=s390x&epoch=7" } } }, { "category": "product_version", "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "product": { "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "product_id": "podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests-debuginfo@5.8.2-9.el10_2?arch=s390x&epoch=7" } } }, { "category": "product_version", "name": "podman-tests-7:5.8.2-9.el10_2.s390x", "product": { "name": "podman-tests-7:5.8.2-9.el10_2.s390x", "product_id": "podman-tests-7:5.8.2-9.el10_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests@5.8.2-9.el10_2?arch=s390x&epoch=7" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "podman-7:5.8.2-9.el10_2.x86_64", "product": { "name": "podman-7:5.8.2-9.el10_2.x86_64", "product_id": "podman-7:5.8.2-9.el10_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman@5.8.2-9.el10_2?arch=x86_64&epoch=7" } } }, { "category": "product_version", "name": "podman-remote-7:5.8.2-9.el10_2.x86_64", "product": { "name": "podman-remote-7:5.8.2-9.el10_2.x86_64", "product_id": "podman-remote-7:5.8.2-9.el10_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote@5.8.2-9.el10_2?arch=x86_64&epoch=7" } } }, { "category": "product_version", "name": "podman-debugsource-7:5.8.2-9.el10_2.x86_64", "product": { "name": "podman-debugsource-7:5.8.2-9.el10_2.x86_64", "product_id": "podman-debugsource-7:5.8.2-9.el10_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debugsource@5.8.2-9.el10_2?arch=x86_64&epoch=7" } } }, { "category": "product_version", "name": "podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "product": { "name": "podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "product_id": "podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debuginfo@5.8.2-9.el10_2?arch=x86_64&epoch=7" } } }, { "category": "product_version", "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "product": { "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "product_id": "podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote-debuginfo@5.8.2-9.el10_2?arch=x86_64&epoch=7" } } }, { "category": "product_version", "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "product": { "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "product_id": "podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests-debuginfo@5.8.2-9.el10_2?arch=x86_64&epoch=7" } } }, { "category": "product_version", "name": "podman-tests-7:5.8.2-9.el10_2.x86_64", "product": { "name": "podman-tests-7:5.8.2-9.el10_2.x86_64", "product_id": "podman-tests-7:5.8.2-9.el10_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests@5.8.2-9.el10_2?arch=x86_64&epoch=7" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "podman-docker-7:5.8.2-9.el10_2.noarch", "product": { "name": "podman-docker-7:5.8.2-9.el10_2.noarch", "product_id": "podman-docker-7:5.8.2-9.el10_2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-docker@5.8.2-9.el10_2?arch=noarch&epoch=7" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "podman-7:5.8.2-9.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64" }, "product_reference": "podman-7:5.8.2-9.el10_2.aarch64", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-7:5.8.2-9.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le" }, "product_reference": "podman-7:5.8.2-9.el10_2.ppc64le", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-7:5.8.2-9.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x" }, "product_reference": "podman-7:5.8.2-9.el10_2.s390x", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-7:5.8.2-9.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src" }, "product_reference": "podman-7:5.8.2-9.el10_2.src", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-7:5.8.2-9.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64" }, "product_reference": "podman-7:5.8.2-9.el10_2.x86_64", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debuginfo-7:5.8.2-9.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64" }, "product_reference": "podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debuginfo-7:5.8.2-9.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le" }, "product_reference": "podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debuginfo-7:5.8.2-9.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x" }, "product_reference": "podman-debuginfo-7:5.8.2-9.el10_2.s390x", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debuginfo-7:5.8.2-9.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64" }, "product_reference": "podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debugsource-7:5.8.2-9.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64" }, "product_reference": "podman-debugsource-7:5.8.2-9.el10_2.aarch64", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debugsource-7:5.8.2-9.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le" }, "product_reference": "podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debugsource-7:5.8.2-9.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x" }, "product_reference": "podman-debugsource-7:5.8.2-9.el10_2.s390x", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debugsource-7:5.8.2-9.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64" }, "product_reference": "podman-debugsource-7:5.8.2-9.el10_2.x86_64", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-docker-7:5.8.2-9.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch" }, "product_reference": "podman-docker-7:5.8.2-9.el10_2.noarch", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-7:5.8.2-9.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64" }, "product_reference": "podman-remote-7:5.8.2-9.el10_2.aarch64", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-7:5.8.2-9.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le" }, "product_reference": "podman-remote-7:5.8.2-9.el10_2.ppc64le", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-7:5.8.2-9.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x" }, "product_reference": "podman-remote-7:5.8.2-9.el10_2.s390x", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-7:5.8.2-9.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64" }, "product_reference": "podman-remote-7:5.8.2-9.el10_2.x86_64", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64" }, "product_reference": "podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le" }, "product_reference": "podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x" }, "product_reference": "podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64" }, "product_reference": "podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64" }, "product_reference": "podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le" }, "product_reference": "podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x" }, "product_reference": "podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id": "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" }, "product_reference": "podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "relates_to_product_reference": "AppStream-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debuginfo-7:5.8.2-9.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64" }, "product_reference": "podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debuginfo-7:5.8.2-9.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le" }, "product_reference": "podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debuginfo-7:5.8.2-9.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x" }, "product_reference": "podman-debuginfo-7:5.8.2-9.el10_2.s390x", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debuginfo-7:5.8.2-9.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64" }, "product_reference": "podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debugsource-7:5.8.2-9.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64" }, "product_reference": "podman-debugsource-7:5.8.2-9.el10_2.aarch64", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debugsource-7:5.8.2-9.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le" }, "product_reference": "podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debugsource-7:5.8.2-9.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x" }, "product_reference": "podman-debugsource-7:5.8.2-9.el10_2.s390x", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debugsource-7:5.8.2-9.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64" }, "product_reference": "podman-debugsource-7:5.8.2-9.el10_2.x86_64", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64" }, "product_reference": "podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le" }, "product_reference": "podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x" }, "product_reference": "podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64" }, "product_reference": "podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-7:5.8.2-9.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64" }, "product_reference": "podman-tests-7:5.8.2-9.el10_2.aarch64", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-7:5.8.2-9.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le" }, "product_reference": "podman-tests-7:5.8.2-9.el10_2.ppc64le", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-7:5.8.2-9.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x" }, "product_reference": "podman-tests-7:5.8.2-9.el10_2.s390x", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-7:5.8.2-9.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64" }, "product_reference": "podman-tests-7:5.8.2-9.el10_2.x86_64", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64" }, "product_reference": "podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le" }, "product_reference": "podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x" }, "product_reference": "podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "relates_to_product_reference": "CRB-10.2.Z" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)", "product_id": "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" }, "product_reference": "podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "relates_to_product_reference": "CRB-10.2.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-17106", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "discovery_date": "2026-08-18T18:51:06.836464+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2518147" } ], "notes": [ { "category": "description", "text": "A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or overwrite files at arbitrary locations on the system where the archive is being extracted. This could lead to unauthorized modification of system files or potentially arbitrary code execution.", "title": "Vulnerability description" }, { "category": "summary", "text": "github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction", "title": "Vulnerability summary" }, { "category": "other", "text": "This Important severity vulnerability in `moby/go-archive` allows for arbitrary file writes during tar extraction. An attacker providing a specially crafted tar archive can exploit symlink following to create or overwrite files outside the intended directory, potentially leading to system compromise in environments processing untrusted archives, such as container build systems.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-17106" }, { "category": "external", "summary": "RHBZ#2518147", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2518147" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-17106", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17106" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-17106", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17106" }, { "category": "external", "summary": "https://docs.docker.com/desktop/release-notes/#4860", "url": "https://docs.docker.com/desktop/release-notes/#4860" }, { "category": "external", "summary": "https://docs.docker.com/engine/release-notes/29/#2970", "url": "https://docs.docker.com/engine/release-notes/29/#2970" }, { "category": "external", "summary": "https://github.com/docker/cli/releases/tag/v29.7.0", "url": "https://github.com/docker/cli/releases/tag/v29.7.0" }, { "category": "external", "summary": "https://github.com/docker/compose/releases/tag/v5.4.0", "url": "https://github.com/docker/compose/releases/tag/v5.4.0" }, { "category": "external", "summary": "https://github.com/docker/sbx-releases/releases/tag/v0.38.0", "url": "https://github.com/docker/sbx-releases/releases/tag/v0.38.0" }, { "category": "external", "summary": "https://github.com/moby/go-archive/releases/tag/v0.3.0", "url": "https://github.com/moby/go-archive/releases/tag/v0.3.0" }, { "category": "external", "summary": "https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h", "url": "https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h" } ], "release_date": "2026-08-18T18:35:13.465000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:19:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70201" }, { "category": "workaround", "details": "To mitigate this issue, avoid processing tar archives from untrusted sources. When handling archives from potentially untrusted origins, ensure that the extraction process is executed with the least privileges necessary to limit the impact of any arbitrary file write attempts.", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction" }, { "acknowledgments": [ { "names": [ "Christopher Lusk" ], "organization": "North Echo Security Research" }, { "names": [ "Paul Holzinger" ], "organization": "Podman" } ], "cve": "CVE-2026-19730", "cwe": { "id": "CWE-459", "name": "Incomplete Cleanup" }, "discovery_date": "2026-07-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2508234" } ], "notes": [ { "category": "description", "text": "The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated and content from the original is preserved. The command completes with no warning.\n\nThere is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files. However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running podman quadlet install --replace to remove a single line from the end of a Quadlet - including security-sensitive content, like AddCapability - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker.\n\nThe vulnerable code paths are in pkg/domain/infra/abi/quadlet.go (lines 338-360, O_CREATE|O_WRONLY without O_TRUNC) and vendor/go.podman.io/storage/pkg/fileutils/reflink_linux.go (lines 12-19, non-truncating io.Copy fallback).", "title": "Vulnerability description" }, { "category": "summary", "text": "podman: podman: Quadlet install --replace non-truncating write retains removed host-access directives", "title": "Vulnerability summary" }, { "category": "other", "text": "CVSS scope note: Reporter (Christopher Lusk) initially scored this Scope Changed (S:C), reasoning that a later compromise or mutable-tag overwrite of the container image could exploit the retained host mount/capability to reach host resources. Upstream maintainer Paul Holzinger (Podman) scored it Scope Unchanged (S:U), noting that this secondary compromise is a separate event the flaw does not itself grant or enable — the flaw's own effect is that Podman fails to enforce a configuration change (a directive removal) that the administrator, via Podman, already had full authority over. Scoped to what the flaw itself contributes, no security authority beyond Podman/the administrator's own control is crossed, so Scope Unchanged is the more accurate classification.\n\nResolved vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L (~4.2, Moderate)", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-19730" }, { "category": "external", "summary": "RHBZ#2508234", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508234" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-19730", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19730" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19730", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19730" }, { "category": "external", "summary": "https://github.com/podman-container-tools/podman/issues/29013", "url": "https://github.com/podman-container-tools/podman/issues/29013" }, { "category": "external", "summary": "https://github.com/podman-container-tools/podman/security/advisories/GHSA-fx76-2j3w-2mx6", "url": "https://github.com/podman-container-tools/podman/security/advisories/GHSA-fx76-2j3w-2mx6" } ], "release_date": "2026-08-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:19:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70201" }, { "category": "workaround", "details": "Patches available at https://github.com/podman-container-tools/podman/commit/a38a9b7d20915c55e6f3c451101ae72d6da33742 for versions 5.8.6 and 6.0.0.\n\nIf patches cannot be used, possible workarounds are to manually copy the quadlet files to the quadlet directory or remove the destination file before running 'podman quadlet install' (without --replace).", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "podman: podman: Quadlet install --replace non-truncating write retains removed host-access directives" }, { "cve": "CVE-2026-33810", "cwe": { "id": "CWE-1289", "name": "Improper Validation of Unsafe Equivalence in Input" }, "discovery_date": "2026-04-08T02:01:09.100830+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2456335" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.", "title": "Vulnerability description" }, { "category": "summary", "text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important flaw in the Go `crypto/x509` package that could allow an attacker to bypass certificate validation. The vulnerability arises from an incorrect application of excluded DNS constraints to wildcard DNS Subject Alternative Names (SANs) when their case differs from the constraint. This could lead to Red Hat products accepting malicious certificates from otherwise trusted chains, compromising the trust model.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-33810" }, { "category": "external", "summary": "RHBZ#2456335", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33810" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810" }, { "category": "external", "summary": "https://go.dev/cl/763763", "url": "https://go.dev/cl/763763" }, { "category": "external", "summary": "https://go.dev/issue/78332", "url": "https://go.dev/issue/78332" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-4866", "url": "https://pkg.go.dev/vuln/GO-2026-4866" } ], "release_date": "2026-04-08T01:06:56.546000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:19:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70201" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application" }, { "cve": "CVE-2026-33818", "cwe": { "id": "CWE-776", "name": "Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')" }, "discovery_date": "2026-08-13T22:12:37.151735+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2515815" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-33818" }, { "category": "external", "summary": "RHBZ#2515815", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818" }, { "category": "external", "summary": "https://go.dev/cl/814980", "url": "https://go.dev/cl/814980" }, { "category": "external", "summary": "https://go.dev/issue/80405", "url": "https://go.dev/issue/80405" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5972", "url": "https://pkg.go.dev/vuln/GO-2026-5972" } ], "release_date": "2026-08-13T21:58:52.821000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:19:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70201" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal" }, { "cve": "CVE-2026-42499", "cwe": { "id": "CWE-1046", "name": "Creation of Immutable Text Using String Concatenation" }, "discovery_date": "2026-05-07T20:00:51.685602+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2467809" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-42499" }, { "category": "external", "summary": "RHBZ#2467809", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42499" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499" }, { "category": "external", "summary": "https://go.dev/cl/771520", "url": "https://go.dev/cl/771520" }, { "category": "external", "summary": "https://go.dev/issue/78987", "url": "https://go.dev/issue/78987" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-4977", "url": "https://pkg.go.dev/vuln/GO-2026-4977" } ], "release_date": "2026-05-07T19:41:18.615000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:19:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70201" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing" }, { "cve": "CVE-2026-56852", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "discovery_date": "2026-07-21T20:01:56.266823+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2504233" } ], "notes": [ { "category": "description", "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input", "title": "Vulnerability summary" }, { "category": "other", "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-56852" }, { "category": "external", "summary": "RHBZ#2504233", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852" }, { "category": "external", "summary": "https://go.dev/cl/794100", "url": "https://go.dev/cl/794100" }, { "category": "external", "summary": "https://go.dev/issue/80142", "url": "https://go.dev/issue/80142" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-5970", "url": "https://pkg.go.dev/vuln/GO-2026-5970" } ], "release_date": "2026-07-21T19:18:59.951000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:19:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70201" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input" }, { "cve": "CVE-2026-56853", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-08-13T22:14:53.561638+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2515827" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.", "title": "Vulnerability description" }, { "category": "summary", "text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-56853" }, { "category": "external", "summary": "RHBZ#2515827", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853" }, { "category": "external", "summary": "https://go.dev/cl/795540", "url": "https://go.dev/cl/795540" }, { "category": "external", "summary": "https://go.dev/issue/80205", "url": "https://go.dev/issue/80205" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-6089", "url": "https://pkg.go.dev/vuln/GO-2026-6089" } ], "release_date": "2026-08-13T21:58:53.092000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:19:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70201" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service" }, { "cve": "CVE-2026-56858", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2026-08-13T22:16:32.034590+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2515838" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.", "title": "Vulnerability description" }, { "category": "summary", "text": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important cross-site scripting (XSS) vulnerability in the Go `html/template` package. Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-56858" }, { "category": "external", "summary": "RHBZ#2515838", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56858", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858" }, { "category": "external", "summary": "https://go.dev/cl/807100", "url": "https://go.dev/cl/807100" }, { "category": "external", "summary": "https://go.dev/issue/80435", "url": "https://go.dev/issue/80435" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-6091", "url": "https://pkg.go.dev/vuln/GO-2026-6091" } ], "release_date": "2026-08-13T21:58:53.354000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:19:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70201" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input" }, { "cve": "CVE-2026-56859", "cwe": { "id": "CWE-776", "name": "Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')" }, "discovery_date": "2026-08-13T22:16:52.493058+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2515840" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.", "title": "Vulnerability description" }, { "category": "summary", "text": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "title": "Vulnerability summary" }, { "category": "other", "text": "An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-56859" }, { "category": "external", "summary": "RHBZ#2515840", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56859", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859" }, { "category": "external", "summary": "https://go.dev/cl/803320", "url": "https://go.dev/cl/803320" }, { "category": "external", "summary": "https://go.dev/issue/80481", "url": "https://go.dev/issue/80481" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-6088", "url": "https://pkg.go.dev/vuln/GO-2026-6088" } ], "release_date": "2026-08-13T21:58:52.959000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:19:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70201" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue" }, { "cve": "CVE-2026-56860", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-08-13T22:13:18.319384+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2515820" } ], "notes": [ { "category": "description", "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.", "title": "Vulnerability description" }, { "category": "summary", "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments ('..') may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-56860" }, { "category": "external", "summary": "RHBZ#2515820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860" }, { "category": "external", "summary": "https://go.dev/cl/803681", "url": "https://go.dev/cl/803681" }, { "category": "external", "summary": "https://go.dev/issue/80494", "url": "https://go.dev/issue/80494" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-6218", "url": "https://pkg.go.dev/vuln/GO-2026-6218" } ], "release_date": "2026-08-13T21:58:53.731000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:19:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70201" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution" }, { "cve": "CVE-2026-56862", "cwe": { "id": "CWE-1050", "name": "Excessive Platform Resource Consumption within a Loop" }, "discovery_date": "2026-08-13T22:16:41.928450+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2515839" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "title": "Vulnerability summary" }, { "category": "other", "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-56862" }, { "category": "external", "summary": "RHBZ#2515839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862" }, { "category": "external", "summary": "https://go.dev/cl/804261", "url": "https://go.dev/cl/804261" }, { "category": "external", "summary": "https://go.dev/issue/80528", "url": "https://go.dev/issue/80528" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-6090", "url": "https://pkg.go.dev/vuln/GO-2026-6090" } ], "release_date": "2026-08-13T21:58:53.216000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-09-22T14:19:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:70201" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.src", "AppStream-10.2.Z:podman-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-docker-7:5.8.2-9.el10_2.noarch", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "AppStream-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-debugsource-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-remote-debuginfo-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-7:5.8.2-9.el10_2.x86_64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.aarch64", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.ppc64le", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.s390x", "CRB-10.2.Z:podman-tests-debuginfo-7:5.8.2-9.el10_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages" } ] }