RHSA-2026:97578: Important: buildah security, bug fix, and enhancement update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs (CVE-2026-46597) Bug Fix(es) and Enhancement(s): Update buildah to 1.43.1 [rhel-9.9] (JIRA:RHEL-170519) Rebase buildah to 1.43.1 [rhel-9.9] (JIRA:RHEL-170601) update to the latest upstream release (JIRA:RHEL-185739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/buildahto a version that resolves this vulnerability.Fixed in 1.43.2-3.el9 - Upgrade
Upgrade
redhat/buildah-debuginfoto a version that resolves this vulnerability.Fixed in 1.43.2-3.el9 - Upgrade
Upgrade
redhat/buildah-debugsourceto a version that resolves this vulnerability.Fixed in 1.43.2-3.el9 - Upgrade
Upgrade
redhat/buildah-teststo a version that resolves this vulnerability.Fixed in 1.43.2-3.el9 - Upgrade
Upgrade
redhat/buildah-tests-debuginfoto a version that resolves this vulnerability.Fixed in 1.43.2-3.el9 - Upgrade
Upgrade
redhat/buildahto a version that resolves this vulnerability.Fixed in 1.43.2-3.el9.aa - Upgrade
Upgrade
redhat/buildah-debuginfoto a version that resolves this vulnerability.Fixed in 1.43.2-3.el9.aa - Upgrade
Upgrade
redhat/buildah-debugsourceto a version that resolves this vulnerability.Fixed in 1.43.2-3.el9.aa - Upgrade
Upgrade
redhat/buildah-teststo a version that resolves this vulnerability.Fixed in 1.43.2-3.el9.aa - Upgrade
Upgrade
redhat/buildah-tests-debuginfoto a version that resolves this vulnerability.Fixed in 1.43.2-3.el9.aa - Upgrade
Upgrade
buildahto a version that resolves this vulnerability.Fixed in 1.43.1
Event History
Frequently Asked Questions
Which systems are covered by this update?
The update applies to Red Hat buildah packages, including buildah, buildah-debuginfo, buildah-debugsource, buildah-tests, and buildah-tests-debuginfo. The update notes identify the RHEL 9.9 buildah release stream.
What denial-of-service conditions are addressed?
The update addresses a denial of service in Go's net package triggered by a long CNAME response processed through LookupCNAME, and a denial of service in golang.org/x/crypto/ssh triggered by crafted AES-GCM packet decoder input.
What Buildah version is included in the update?
The advisory states that Buildah is updated or rebased to version 1.43.1 for RHEL 9.9.