Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Buildah may crash or be slowed by crafted SSH keys

published 4 months ago

Summary

The Buildah container tool on AlmaLinux can be forced to stop working or become very slow when it processes specially crafted SSH keys or certain certificate checks. This happens because the software does not limit the size of some cryptographic values. Updating Buildah to the latest version provided by AlmaLinux resolves the issue.

What to do

Update almalinux buildah to version 2:1.39.6-1.el9_2.tuxcare.els9.
Update almalinux buildah-tests to version 2:1.39.6-1.el9_2.tuxcare.els9.

Affected software

Ecosystem	Vendor	Product	Affected versions
TuxCare:AlmaLinux:9.2	almalinux	buildah	< 2:1.39.6-1.el9_2.tuxcare.els9 Fix: upgrade to 2:1.39.6-1.el9_2.tuxcare.els9
TuxCare:AlmaLinux:9.2	almalinux	buildah-tests	< 2:1.39.6-1.el9_2.tuxcare.els9 Fix: upgrade to 2:1.39.6-1.el9_2.tuxcare.els9

Original advisory text

buildah: Fix of CVE-2026-39829

- CVE-2026-39829: fix DoS in vendored golang.org/x/crypto/ssh public-key
parsing (cap RSA moduli at 8192 bits, validate DSA parameters per
FIPS 186-2); affects both el9_2 and el9_6
- CVE-2026-32281: rebuild el9_6 against golang >= 1.25.7-1.el9_6.tuxcare.els7
to fix DoS in crypto/x509 policy validation (Go >= 1.24 only; el9_2 builds
with Go 1.22.9 and is not affected)

References

https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1782810335.html Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39829 Vendor Advisory

Timeline

Published30 Jun 2026

Updated26 Oct 2026

First seen26 Oct 2026

Sources

CLSA-2026-1782810335 · OSV

Track software like this

Free during beta