RHSA-2026:98554: Important: podman security update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.Security Fix(es): encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/podmanto a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3 - Upgrade
Upgrade
redhat/podman-debuginfoto a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3 - Upgrade
Upgrade
redhat/podman-debugsourceto a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3 - Upgrade
Upgrade
redhat/podman-dockerto a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3 - Upgrade
Upgrade
redhat/podman-remoteto a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3 - Upgrade
Upgrade
redhat/podman-remote-debuginfoto a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3 - Upgrade
Upgrade
redhat/podman-tests-debuginfoto a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3 - Upgrade
Upgrade
redhat/podmanto a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3.aa - Upgrade
Upgrade
redhat/podman-debuginfoto a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3.aa - Upgrade
Upgrade
redhat/podman-debugsourceto a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3.aa - Upgrade
Upgrade
redhat/podman-remoteto a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3.aa - Upgrade
Upgrade
redhat/podman-remote-debuginfoto a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3.aa - Upgrade
Upgrade
redhat/podman-tests-debuginfoto a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3.aa - Upgrade
Upgrade
redhat/podman-teststo a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3 - Upgrade
Upgrade
redhat/podman-teststo a version that resolves this vulnerability.Fixed in 6.1.1-1.el10_3.aa
Event History
Frequently Asked Questions
Which installed packages are covered by this update?
The update covers redhat/podman and related packages: podman-debuginfo, podman-debugsource, podman-remote, podman-remote-debuginfo, podman-tests, podman-tests-debuginfo, and podman-docker.
What types of attacks are addressed?
The fixes address multiple denial-of-service conditions in Go components, cross-site scripting in html/template, and an arbitrary file-write issue in moby/go-archive caused by following links during tar extraction.
What attacker interaction is indicated for the arbitrary file-write issue?
The available data identifies tar extraction with link following as the condition for CVE-2026-17106. It does not state whether exploitation requires a specific Podman configuration or whether the behavior is enabled by default.