Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Podman 5.6.1-10 can be forced to waste resources via SSH

published 5 months ago

Summary

Podman version 5.6.1-10 may let a malicious SSH client send unexpected messages that fill internal storage, causing the program to hang and keep using memory. This can slow down or stop container operations on the affected system. Upgrade to a newer Podman release where these unwanted messages are ignored, or apply the provided patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Azure Linux:3	azure	podman	<= 5.6.1-10

Original advisory text

CVE-2026-39830 affecting package podman 5.6.1-10

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-39830 URL

Timeline

Published22 May 2026

Updated23 Sep 2026

First seen23 Sep 2026

Sources

AZL-87311 · OSV

Track software like this

Free during beta