Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Important: buildah security update
published 4 months ago
Summary
A security update is available for the buildah package, which is used to build container images. This update fixes multiple security issues that could allow an attacker to cause a denial of service or potentially exploit other vulnerabilities. To stay secure, update your buildah package to the latest version.
What to do
- Update almalinux buildah to version 2:1.43.1-2.el10_2.
- Update almalinux buildah-tests to version 2:1.43.1-2.el10_2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | buildah |
< 2:1.43.1-2.el10_2 Fix: upgrade to 2:1.43.1-2.el10_2
|
| AlmaLinux:10 | almalinux | buildah-tests |
< 2:1.43.1-2.el10_2 Fix: upgrade to 2:1.43.1-2.el10_2
|
Original advisory text
Important: buildah security update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:29195 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-25679 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-32280 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-32281 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-32283 Third Party Advisory
- https://bugzilla.redhat.com/2445356 Third Party Advisory
- https://bugzilla.redhat.com/2456333 Third Party Advisory
- https://bugzilla.redhat.com/2456338 Third Party Advisory
- https://bugzilla.redhat.com/2456339 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-29195.html Vendor Advisory
Timeline
Published24 Jun 2026
Updated25 Jun 2026
First seen25 Jun 2026
Sources
ALSA-2026:29195 · OSV
Track software like this
Free during beta