RHSA-2026:97560: Important: runc security update

Q: What condition is required to trigger the denial of service?

The issue is triggered through Go's LookupCNAME handling of a long CNAME response. The advisory does not specify the required network position, request path, or other attacker prerequisites.

Q: Which packages are covered by this update?

The update covers redhat/runc, redhat/runc-debuginfo, and redhat/runc-debugsource.

Q: What temporary mitigation is documented if the update cannot be applied immediately?

No temporary mitigation or workaround is provided in the advisory.

Q: How can I determine whether my environment is affected?

The advisory identifies the affected packages but does not provide affected or fixed package versions. Compare installed package information with the package versions supplied by the applicable Red Hat update.

Published Nov 10, 2026

Updated

The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.Security Fix(es): net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.

Affected Software

12 affected componentsFixes available

redhat/runc<1.4.2-2.el9

1.4.2-2.el9

redhat/runc<1.4.2-2.el9

1.4.2-2.el9

redhat/runc-debuginfo<1.4.2-2.el9

1.4.2-2.el9

redhat/runc-debugsource<1.4.2-2.el9

1.4.2-2.el9

redhat/runc-debuginfo<1.4.2-2.el9

1.4.2-2.el9

redhat/runc-debugsource<1.4.2-2.el9

1.4.2-2.el9

redhat/runc<1.4.2-2.el9

1.4.2-2.el9

redhat/runc-debuginfo<1.4.2-2.el9

1.4.2-2.el9

redhat/runc-debugsource<1.4.2-2.el9

1.4.2-2.el9

redhat/runc<1.4.2-2.el9.aa

1.4.2-2.el9.aa

redhat/runc-debuginfo<1.4.2-2.el9.aa

1.4.2-2.el9.aa

redhat/runc-debugsource<1.4.2-2.el9.aa

1.4.2-2.el9.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/runc to a version that resolves this vulnerability.
Fixed in 1.4.2-2.el9
Upgrade
Upgrade redhat/runc-debuginfo to a version that resolves this vulnerability.
Fixed in 1.4.2-2.el9
Upgrade
Upgrade redhat/runc-debugsource to a version that resolves this vulnerability.
Fixed in 1.4.2-2.el9
Upgrade
Upgrade redhat/runc to a version that resolves this vulnerability.
Fixed in 1.4.2-2.el9.aa
Upgrade
Upgrade redhat/runc-debuginfo to a version that resolves this vulnerability.
Fixed in 1.4.2-2.el9.aa
Upgrade
Upgrade redhat/runc-debugsource to a version that resolves this vulnerability.
Fixed in 1.4.2-2.el9.aa

Event History

Nov 10, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

What condition is required to trigger the denial of service?

The issue is triggered through Go's LookupCNAME handling of a long CNAME response. The advisory does not specify the required network position, request path, or other attacker prerequisites.

Which packages are covered by this update?

The update covers redhat/runc, redhat/runc-debuginfo, and redhat/runc-debugsource.

What temporary mitigation is documented if the update cannot be applied immediately?

No temporary mitigation or workaround is provided in the advisory.

How can I determine whether my environment is affected?

The advisory identifies the affected packages but does not provide affected or fixed package versions. Compare installed package information with the package versions supplied by the applicable Red Hat update.

RHSA-2026:97560: Important: runc security update

Affected Software

Remediation

Event History

Frequently Asked Questions

What condition is required to trigger the denial of service?

Which packages are covered by this update?

What temporary mitigation is documented if the update cannot be applied immediately?

How can I determine whether my environment is affected?

Company

Resources

Contact

Frequently Asked Questions

What condition is required to trigger the denial of service?

Which packages are covered by this update?

What temporary mitigation is documented if the update cannot be applied immediately?

How can I determine whether my environment is affected?