Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Buildah can be forced to use excess memory via Trailer headers
published 27 days ago
Summary
The Buildah container tool’s built‑in HTTP server can be tricked by a client that sends many Trailer headers. This makes the server allocate a large amount of memory, potentially slowing or crashing the service. Update Buildah to the latest version or apply the vendor’s patch to limit the number of Trailer entries.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | buildah | <= 1.43.1-3 |
Original advisory text
CVE-2026-78659 affecting package buildah 1.43.1-3
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.
References
Timeline
Published8 Oct 2026
Updated11 Oct 2026
First seen11 Oct 2026
Sources
AZL-107039 · OSV
Track software like this
Free during beta