Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux runc may accept expired certificates
published 8 months ago
Summary
The runc component in AlmaLinux can be fooled into using outdated security certificates, which could let attackers intercept secure connections. It can also use excessive memory when handling certain web requests or generate overly large error messages, potentially slowing the system. Updating runc with the latest release fixes these issues, so apply the newest package as soon as possible.
What to do
- Update almalinux runc to version 4:1.2.8-1.el9_1.tuxcare.els2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.2 | almalinux | runc |
< 4:1.2.8-1.el9_1.tuxcare.els2 Fix: upgrade to 4:1.2.8-1.el9_1.tuxcare.els2
|
Original advisory text
runc: Fix of 3 CVEs
- rebuild with newer golang version 1.22.9-1.el9_2.tuxcare.els6 to fix the following CVE's
- CVE-2025-68121: fix TLS session resumption bypass by preventing shared
auto-rotated ticket keys in Config and validating full certificate chain expiry
- CVE-2025-61726: limit parsed URL query parameters to mitigate excessive memory
consumption during form parsing
- CVE-2025-61729: fix excessive resource consumption when constructing hostname
error messages for certificates with many SANs
- CVE-2025-68121: fix TLS session resumption bypass by preventing shared
auto-rotated ticket keys in Config and validating full certificate chain expiry
- CVE-2025-61726: limit parsed URL query parameters to mitigate excessive memory
consumption during form parsing
- CVE-2025-61729: fix excessive resource consumption when constructing hostname
error messages for certificates with many SANs
References
Timeline
Published2 Mar 2026
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLSA-2026-1772456031 · OSV
Track software like this
Free during beta