Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
podman: Inefficient Certificate Validation Risks Denial of Service
published 5 months ago
Summary
A security update is available for podman, a tool that manages containers and images. This update fixes three issues that could allow an attacker to slow down or crash the system by sending a specific type of message. To stay secure, update podman to the latest version.
What to do
- Update almalinux podman to version 7:5.8.2-3.el10_2.alma.1.
- Update almalinux podman-docker to version 7:5.8.2-3.el10_2.alma.1.
- Update almalinux podman-remote to version 7:5.8.2-3.el10_2.alma.1.
- Update almalinux podman-tests to version 7:5.8.2-3.el10_2.alma.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | podman |
< 7:5.8.2-3.el10_2.alma.1 Fix: upgrade to 7:5.8.2-3.el10_2.alma.1
|
| AlmaLinux:10 | almalinux | podman-docker |
< 7:5.8.2-3.el10_2.alma.1 Fix: upgrade to 7:5.8.2-3.el10_2.alma.1
|
| AlmaLinux:10 | almalinux | podman-remote |
< 7:5.8.2-3.el10_2.alma.1 Fix: upgrade to 7:5.8.2-3.el10_2.alma.1
|
| AlmaLinux:10 | almalinux | podman-tests |
< 7:5.8.2-3.el10_2.alma.1 Fix: upgrade to 7:5.8.2-3.el10_2.alma.1
|
Original advisory text
Important: podman security update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:24470 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-32280 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-32281 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-32283 Third Party Advisory
- https://bugzilla.redhat.com/2456333 Third Party Advisory
- https://bugzilla.redhat.com/2456338 Third Party Advisory
- https://bugzilla.redhat.com/2456339 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-24470.html Vendor Advisory
Timeline
Published8 Jun 2026
Updated11 Jun 2026
First seen11 Jun 2026
Sources
ALSA-2026:24470 · OSV
Track software like this
Free during beta