Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Cockpit-podman Update Fixes CPU and Memory Crash Risk
published 6 months ago
Summary
A security update for cockpit-podman fixes two issues that could cause a Node.js process to consume excessive CPU and memory, potentially crashing the system. This may happen when processing certain types of file paths. To stay secure, update cockpit-podman to the latest version.
What to do
- Update opensuse cockpit-podman to version 117-160000.2.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openSUSE:Leap 16.0 | opensuse | cockpit-podman |
< 117-160000.2.1 Fix: upgrade to 117-160000.2.1
|
Original advisory text
Security update for cockpit-podman
This update for cockpit-podman fixes the following issues:
- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and
may crash a Node.js process (bsc#1257836).
- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character
that doesn't appear in the test string (bsc#1258641).
- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and
may crash a Node.js process (bsc#1257836).
- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character
that doesn't appear in the test string (bsc#1258641).
References
- https://bugzilla.suse.com/1257836 Third Party Advisory
- https://bugzilla.suse.com/1258641 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-25547 URL
- https://www.suse.com/security/cve/CVE-2026-26996 URL
Timeline
Published10 Apr 2026
Updated22 Apr 2026
First seen22 Apr 2026
Sources
openSUSE-SU-2026:20502-1 · OSV
Track software like this
Free during beta