RLSA-2026:90424: Important: buildah security update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)
golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855)
net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/buildahto a version that resolves this vulnerability.Fixed in 2:1.43.4-2.el9_8
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which security issues are addressed by this update?
The update addresses an arbitrary file write in podman when importing an OCI archive, denial-of-service issues in golang.org/x/crypto/ssh and net/http, and a crypto/x509 issue that could enable man-in-the-middle attacks through untrusted intermediate certificates.
What kind of availability impact is identified?
The listed golang.org/x/crypto/ssh and net/http issues are denial-of-service vulnerabilities triggered by crafted messages and crafted HTTP Range headers, respectively. The advisory’s overall vector rates availability impact as high.
Is authentication or user interaction required according to the advisory’s severity vector?
No. The supplied vector indicates network attack access, low attack complexity, no privileges required, and no user interaction required.