RHSA-2026:98451: Important: runc security update
The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.Security Fix(es): net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/runcto a version that resolves this vulnerability.Fixed in 1.4.2-3.el9_9 - Upgrade
Upgrade
redhat/runc-debuginfoto a version that resolves this vulnerability.Fixed in 1.4.2-3.el9_9 - Upgrade
Upgrade
redhat/runc-debugsourceto a version that resolves this vulnerability.Fixed in 1.4.2-3.el9_9 - Upgrade
Upgrade
redhat/runcto a version that resolves this vulnerability.Fixed in 1.4.2-3.el9_9.aa - Upgrade
Upgrade
redhat/runc-debuginfoto a version that resolves this vulnerability.Fixed in 1.4.2-3.el9_9.aa - Upgrade
Upgrade
redhat/runc-debugsourceto a version that resolves this vulnerability.Fixed in 1.4.2-3.el9_9.aa
Event History
Frequently Asked Questions
Which installed packages are covered by this update?
The advisory lists redhat/runc, redhat/runc-debuginfo, and redhat/runc-debugsource.
What type of impact does the addressed issue have?
The fix addresses CVE-2026-56860, a denial-of-service issue in Go's net/url path resolution caused by quadratic complexity.