Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Buildah may let attackers crash or spoof container builds
published 2 months ago
Summary
The Buildah tool used to create container images has several bugs that could allow attackers to disrupt the building process, cause the program to stop working, or inject malicious content. These problems affect certificate checks, email handling, URL processing, HTTP/2 connections, and template rendering within the software. Install the latest Buildah update as soon as possible to protect your systems.
What to do
- Update almalinux buildah to version 2:1.43.1-5.el10_2.
- Update almalinux buildah-tests to version 2:1.43.1-5.el10_2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | buildah |
< 2:1.43.1-5.el10_2 Fix: upgrade to 2:1.43.1-5.el10_2
|
| AlmaLinux:10 | almalinux | buildah-tests |
< 2:1.43.1-5.el10_2 Fix: upgrade to 2:1.43.1-5.el10_2
|
Original advisory text
Important: buildah security update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:63332 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-33810 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-33818 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-56853 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-56858 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-56860 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-56862 Third Party Advisory
- https://bugzilla.redhat.com/2456335 Third Party Advisory
- https://bugzilla.redhat.com/2467809 Third Party Advisory
- https://bugzilla.redhat.com/2515815 Third Party Advisory
- https://bugzilla.redhat.com/2515820 Third Party Advisory
- https://bugzilla.redhat.com/2515827 Third Party Advisory
- https://bugzilla.redhat.com/2515838 Third Party Advisory
- https://bugzilla.redhat.com/2515839 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-63332.html Vendor Advisory
Timeline
Published3 Sep 2026
Updated5 Sep 2026
First seen5 Sep 2026
Sources
ALSA-2026:63332 · OSV
Track software like this
Free during beta