RHSA-2026:97644: Important: containernetworking-plugins security, bug fix, and enhancement update
The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted. Security Fix(es): net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) Bug Fix(es) and Enhancement(s): containernetworking-plugins - update to the latest upstream release (JIRA:RHEL-212439) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/containernetworking-pluginsto a version that resolves this vulnerability.Fixed in 1.9.1-2.el9 - Upgrade
Upgrade
redhat/containernetworking-plugins-debuginfoto a version that resolves this vulnerability.Fixed in 1.9.1-2.el9 - Upgrade
Upgrade
redhat/containernetworking-plugins-debugsourceto a version that resolves this vulnerability.Fixed in 1.9.1-2.el9 - Upgrade
Upgrade
redhat/containernetworking-pluginsto a version that resolves this vulnerability.Fixed in 1.9.1-2.el9.aa - Upgrade
Upgrade
redhat/containernetworking-plugins-debuginfoto a version that resolves this vulnerability.Fixed in 1.9.1-2.el9.aa - Upgrade
Upgrade
redhat/containernetworking-plugins-debugsourceto a version that resolves this vulnerability.Fixed in 1.9.1-2.el9.aa
Event History
Frequently Asked Questions
Which installed package artifacts should be included in an inventory check?
Check for redhat/containernetworking-plugins, redhat/containernetworking-plugins-debuginfo, and redhat/containernetworking-plugins-debugsource. The advisory does not provide affected or fixed package version numbers.
Are exploit prerequisites, exposed configurations, or default-configuration impact specified?
No. The available information identifies denial-of-service issues in Go LookupCNAME handling and processing of DNS SAN entries, but does not state attacker access requirements, affected deployments, or whether default configurations are exposed.
What mitigation is documented if the update cannot be applied immediately?
No temporary mitigation or workaround is provided. The stated remediation is an update of containernetworking-plugins to the latest upstream release.
How can we confirm whether a specific installed system is vulnerable?
The supplied advisory data does not include version ranges or fixed builds, so vulnerability status cannot be confirmed from it alone. It points to the listed CVE and bug references for additional issue details.