{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for podman is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.\n\nSecurity Fix(es):\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\n* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2026:17287", "url": "https://access.redhat.com/errata/RHSA-2026:17287" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2445356", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356" }, { "category": "external", "summary": "2455470", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470" }, { "category": "external", "summary": "2456338", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338" }, { "category": "external", "summary": "2456339", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_17287.json" } ], "title": "Red Hat Security Advisory: podman security update", "tracking": { "current_release_date": "2026-07-02T10:24:14+00:00", "generator": { "date": "2026-07-02T10:24:14+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.1" } }, "id": "RHSA-2026:17287", "initial_release_date": "2026-05-13T19:33:51+00:00", "revision_history": [ { "date": "2026-05-13T19:33:51+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-05-13T19:33:51+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2026-07-02T10:24:14+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:9.6::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "podman-5:5.4.0-20.el9_6.3.x86_64", "product": { "name": "podman-5:5.4.0-20.el9_6.3.x86_64", "product_id": "podman-5:5.4.0-20.el9_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman@5.4.0-20.el9_6.3?arch=x86_64&epoch=5" } } }, { "category": "product_version", "name": "podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "product": { "name": "podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "product_id": "podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-plugins@5.4.0-20.el9_6.3?arch=x86_64&epoch=5" } } }, { "category": "product_version", "name": "podman-remote-5:5.4.0-20.el9_6.3.x86_64", "product": { "name": "podman-remote-5:5.4.0-20.el9_6.3.x86_64", "product_id": "podman-remote-5:5.4.0-20.el9_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote@5.4.0-20.el9_6.3?arch=x86_64&epoch=5" } } }, { "category": "product_version", "name": "podman-tests-5:5.4.0-20.el9_6.3.x86_64", "product": { "name": "podman-tests-5:5.4.0-20.el9_6.3.x86_64", "product_id": "podman-tests-5:5.4.0-20.el9_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests@5.4.0-20.el9_6.3?arch=x86_64&epoch=5" } } }, { "category": "product_version", "name": "podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "product": { "name": "podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "product_id": "podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debugsource@5.4.0-20.el9_6.3?arch=x86_64&epoch=5" } } }, { "category": "product_version", "name": "podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "product": { "name": "podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "product_id": "podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debuginfo@5.4.0-20.el9_6.3?arch=x86_64&epoch=5" } } }, { "category": "product_version", "name": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "product": { "name": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "product_id": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-plugins-debuginfo@5.4.0-20.el9_6.3?arch=x86_64&epoch=5" } } }, { "category": "product_version", "name": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "product": { "name": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "product_id": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote-debuginfo@5.4.0-20.el9_6.3?arch=x86_64&epoch=5" } } }, { "category": "product_version", "name": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "product": { "name": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "product_id": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests-debuginfo@5.4.0-20.el9_6.3?arch=x86_64&epoch=5" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "podman-5:5.4.0-20.el9_6.3.src", "product": { "name": "podman-5:5.4.0-20.el9_6.3.src", "product_id": "podman-5:5.4.0-20.el9_6.3.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman@5.4.0-20.el9_6.3?arch=src&epoch=5" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "podman-5:5.4.0-20.el9_6.3.aarch64", "product": { "name": "podman-5:5.4.0-20.el9_6.3.aarch64", "product_id": "podman-5:5.4.0-20.el9_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman@5.4.0-20.el9_6.3?arch=aarch64&epoch=5" } } }, { "category": "product_version", "name": "podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "product": { "name": "podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "product_id": "podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-plugins@5.4.0-20.el9_6.3?arch=aarch64&epoch=5" } } }, { "category": "product_version", "name": "podman-remote-5:5.4.0-20.el9_6.3.aarch64", "product": { "name": "podman-remote-5:5.4.0-20.el9_6.3.aarch64", "product_id": "podman-remote-5:5.4.0-20.el9_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote@5.4.0-20.el9_6.3?arch=aarch64&epoch=5" } } }, { "category": "product_version", "name": "podman-tests-5:5.4.0-20.el9_6.3.aarch64", "product": { "name": "podman-tests-5:5.4.0-20.el9_6.3.aarch64", "product_id": "podman-tests-5:5.4.0-20.el9_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests@5.4.0-20.el9_6.3?arch=aarch64&epoch=5" } } }, { "category": "product_version", "name": "podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "product": { "name": "podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "product_id": "podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debugsource@5.4.0-20.el9_6.3?arch=aarch64&epoch=5" } } }, { "category": "product_version", "name": "podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "product": { "name": "podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "product_id": "podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debuginfo@5.4.0-20.el9_6.3?arch=aarch64&epoch=5" } } }, { "category": "product_version", "name": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "product": { "name": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "product_id": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-plugins-debuginfo@5.4.0-20.el9_6.3?arch=aarch64&epoch=5" } } }, { "category": "product_version", "name": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "product": { "name": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "product_id": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote-debuginfo@5.4.0-20.el9_6.3?arch=aarch64&epoch=5" } } }, { "category": "product_version", "name": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "product": { "name": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "product_id": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests-debuginfo@5.4.0-20.el9_6.3?arch=aarch64&epoch=5" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "podman-5:5.4.0-20.el9_6.3.ppc64le", "product": { "name": "podman-5:5.4.0-20.el9_6.3.ppc64le", "product_id": "podman-5:5.4.0-20.el9_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman@5.4.0-20.el9_6.3?arch=ppc64le&epoch=5" } } }, { "category": "product_version", "name": "podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "product": { "name": "podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "product_id": "podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-plugins@5.4.0-20.el9_6.3?arch=ppc64le&epoch=5" } } }, { "category": "product_version", "name": "podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "product": { "name": "podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "product_id": "podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote@5.4.0-20.el9_6.3?arch=ppc64le&epoch=5" } } }, { "category": "product_version", "name": "podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "product": { "name": "podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "product_id": "podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests@5.4.0-20.el9_6.3?arch=ppc64le&epoch=5" } } }, { "category": "product_version", "name": "podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "product": { "name": "podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "product_id": "podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debugsource@5.4.0-20.el9_6.3?arch=ppc64le&epoch=5" } } }, { "category": "product_version", "name": "podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "product": { "name": "podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "product_id": "podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debuginfo@5.4.0-20.el9_6.3?arch=ppc64le&epoch=5" } } }, { "category": "product_version", "name": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "product": { "name": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "product_id": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-plugins-debuginfo@5.4.0-20.el9_6.3?arch=ppc64le&epoch=5" } } }, { "category": "product_version", "name": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "product": { "name": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "product_id": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote-debuginfo@5.4.0-20.el9_6.3?arch=ppc64le&epoch=5" } } }, { "category": "product_version", "name": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "product": { "name": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "product_id": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests-debuginfo@5.4.0-20.el9_6.3?arch=ppc64le&epoch=5" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "podman-5:5.4.0-20.el9_6.3.s390x", "product": { "name": "podman-5:5.4.0-20.el9_6.3.s390x", "product_id": "podman-5:5.4.0-20.el9_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman@5.4.0-20.el9_6.3?arch=s390x&epoch=5" } } }, { "category": "product_version", "name": "podman-plugins-5:5.4.0-20.el9_6.3.s390x", "product": { "name": "podman-plugins-5:5.4.0-20.el9_6.3.s390x", "product_id": "podman-plugins-5:5.4.0-20.el9_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-plugins@5.4.0-20.el9_6.3?arch=s390x&epoch=5" } } }, { "category": "product_version", "name": "podman-remote-5:5.4.0-20.el9_6.3.s390x", "product": { "name": "podman-remote-5:5.4.0-20.el9_6.3.s390x", "product_id": "podman-remote-5:5.4.0-20.el9_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote@5.4.0-20.el9_6.3?arch=s390x&epoch=5" } } }, { "category": "product_version", "name": "podman-tests-5:5.4.0-20.el9_6.3.s390x", "product": { "name": "podman-tests-5:5.4.0-20.el9_6.3.s390x", "product_id": "podman-tests-5:5.4.0-20.el9_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests@5.4.0-20.el9_6.3?arch=s390x&epoch=5" } } }, { "category": "product_version", "name": "podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "product": { "name": "podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "product_id": "podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debugsource@5.4.0-20.el9_6.3?arch=s390x&epoch=5" } } }, { "category": "product_version", "name": "podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "product": { "name": "podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "product_id": "podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-debuginfo@5.4.0-20.el9_6.3?arch=s390x&epoch=5" } } }, { "category": "product_version", "name": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "product": { "name": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "product_id": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-plugins-debuginfo@5.4.0-20.el9_6.3?arch=s390x&epoch=5" } } }, { "category": "product_version", "name": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "product": { "name": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "product_id": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-remote-debuginfo@5.4.0-20.el9_6.3?arch=s390x&epoch=5" } } }, { "category": "product_version", "name": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "product": { "name": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "product_id": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-tests-debuginfo@5.4.0-20.el9_6.3?arch=s390x&epoch=5" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "podman-docker-5:5.4.0-20.el9_6.3.noarch", "product": { "name": "podman-docker-5:5.4.0-20.el9_6.3.noarch", "product_id": "podman-docker-5:5.4.0-20.el9_6.3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/podman-docker@5.4.0-20.el9_6.3?arch=noarch&epoch=5" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "podman-5:5.4.0-20.el9_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64" }, "product_reference": "podman-5:5.4.0-20.el9_6.3.aarch64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-5:5.4.0-20.el9_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le" }, "product_reference": "podman-5:5.4.0-20.el9_6.3.ppc64le", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-5:5.4.0-20.el9_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x" }, "product_reference": "podman-5:5.4.0-20.el9_6.3.s390x", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-5:5.4.0-20.el9_6.3.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src" }, "product_reference": "podman-5:5.4.0-20.el9_6.3.src", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-5:5.4.0-20.el9_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64" }, "product_reference": "podman-5:5.4.0-20.el9_6.3.x86_64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64" }, "product_reference": "podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le" }, "product_reference": "podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debuginfo-5:5.4.0-20.el9_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x" }, "product_reference": "podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64" }, "product_reference": "podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debugsource-5:5.4.0-20.el9_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64" }, "product_reference": "podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le" }, "product_reference": "podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debugsource-5:5.4.0-20.el9_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x" }, "product_reference": "podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-debugsource-5:5.4.0-20.el9_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64" }, "product_reference": "podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-docker-5:5.4.0-20.el9_6.3.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch" }, "product_reference": "podman-docker-5:5.4.0-20.el9_6.3.noarch", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-plugins-5:5.4.0-20.el9_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64" }, "product_reference": "podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-plugins-5:5.4.0-20.el9_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le" }, "product_reference": "podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-plugins-5:5.4.0-20.el9_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x" }, "product_reference": "podman-plugins-5:5.4.0-20.el9_6.3.s390x", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-plugins-5:5.4.0-20.el9_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64" }, "product_reference": "podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64" }, "product_reference": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le" }, "product_reference": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x" }, "product_reference": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64" }, "product_reference": "podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-5:5.4.0-20.el9_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64" }, "product_reference": "podman-remote-5:5.4.0-20.el9_6.3.aarch64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-5:5.4.0-20.el9_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le" }, "product_reference": "podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-5:5.4.0-20.el9_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x" }, "product_reference": "podman-remote-5:5.4.0-20.el9_6.3.s390x", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-5:5.4.0-20.el9_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64" }, "product_reference": "podman-remote-5:5.4.0-20.el9_6.3.x86_64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64" }, "product_reference": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le" }, "product_reference": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x" }, "product_reference": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64" }, "product_reference": "podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-5:5.4.0-20.el9_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64" }, "product_reference": "podman-tests-5:5.4.0-20.el9_6.3.aarch64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-5:5.4.0-20.el9_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le" }, "product_reference": "podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-5:5.4.0-20.el9_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x" }, "product_reference": "podman-tests-5:5.4.0-20.el9_6.3.s390x", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-5:5.4.0-20.el9_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64" }, "product_reference": "podman-tests-5:5.4.0-20.el9_6.3.x86_64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64" }, "product_reference": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le" }, "product_reference": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x" }, "product_reference": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)", "product_id": "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" }, "product_reference": "podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "relates_to_product_reference": "AppStream-9.6.0.Z.EUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-25679", "cwe": { "id": "CWE-1286", "name": "Improper Validation of Syntactic Correctness of Input" }, "discovery_date": "2026-03-06T22:02:11.567841+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2445356" } ], "notes": [ { "category": "description", "text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.", "title": "Vulnerability description" }, { "category": "summary", "text": "net/url: Incorrect parsing of IPv6 host literals in net/url", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-25679" }, { "category": "external", "summary": "RHBZ#2445356", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679" }, { "category": "external", "summary": "https://go.dev/cl/752180", "url": "https://go.dev/cl/752180" }, { "category": "external", "summary": "https://go.dev/issue/77578", "url": "https://go.dev/issue/77578" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk", "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-4601", "url": "https://pkg.go.dev/vuln/GO-2026-4601" } ], "release_date": "2026-03-06T21:28:14.211000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-05-13T19:33:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:17287" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "net/url: Incorrect parsing of IPv6 host literals in net/url" }, { "cve": "CVE-2026-32280", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "discovery_date": "2026-04-08T02:01:19.572351+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2456339" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.", "title": "Vulnerability description" }, { "category": "summary", "text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-32280" }, { "category": "external", "summary": "RHBZ#2456339", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32280" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280" }, { "category": "external", "summary": "https://go.dev/cl/758320", "url": "https://go.dev/cl/758320" }, { "category": "external", "summary": "https://go.dev/issue/78282", "url": "https://go.dev/issue/78282" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-4947", "url": "https://pkg.go.dev/vuln/GO-2026-4947" } ], "release_date": "2026-04-08T01:06:58.595000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-05-13T19:33:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:17287" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building" }, { "cve": "CVE-2026-32283", "cwe": { "id": "CWE-764", "name": "Multiple Locks of a Critical Resource" }, "discovery_date": "2026-04-08T02:01:16.213799+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2456338" } ], "notes": [ { "category": "description", "text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).", "title": "Vulnerability description" }, { "category": "summary", "text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-32283" }, { "category": "external", "summary": "RHBZ#2456338", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32283" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283" }, { "category": "external", "summary": "https://go.dev/cl/763767", "url": "https://go.dev/cl/763767" }, { "category": "external", "summary": "https://go.dev/issue/78334", "url": "https://go.dev/issue/78334" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-4870", "url": "https://pkg.go.dev/vuln/GO-2026-4870" } ], "release_date": "2026-04-08T01:06:57.670000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-05-13T19:33:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:17287" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages" }, { "cve": "CVE-2026-34986", "cwe": { "id": "CWE-131", "name": "Incorrect Calculation of Buffer Size" }, "discovery_date": "2026-04-06T17:01:34.639203+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2455470" } ], "notes": [ { "category": "description", "text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.", "title": "Vulnerability description" }, { "category": "summary", "text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-34986" }, { "category": "external", "summary": "RHBZ#2455470", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34986" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986" }, { "category": "external", "summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8", "url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8" }, { "category": "external", "summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants", "url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants" } ], "release_date": "2026-04-06T16:22:45.353000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-05-13T19:33:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:17287" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.src", "AppStream-9.6.0.Z.EUS:podman-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-debugsource-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-docker-5:5.4.0-20.el9_6.3.noarch", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-plugins-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-remote-debuginfo-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-5:5.4.0-20.el9_6.3.x86_64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.aarch64", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.ppc64le", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.s390x", "AppStream-9.6.0.Z.EUS:podman-tests-debuginfo-5:5.4.0-20.el9_6.3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object" } ] }