RLSA-2026:97644: Important: containernetworking-plugins security, bug fix, and enhancement update
The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.
Security Fix(es):
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
Bug Fix(es) and Enhancement(s):
containernetworking-plugins - update to the latest upstream release (JIRA:Rocky Linux-212439)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/containernetworking-pluginsto a version that resolves this vulnerability.Fixed in 1:1.9.1-2.el9 - Upgrade
Upgrade
rocky-linux/containernetworking-plugins-debuginfoto a version that resolves this vulnerability.Fixed in 1:1.9.1-2.el9 - Upgrade
Upgrade
rocky-linux/containernetworking-plugins-debugsourceto a version that resolves this vulnerability.Fixed in 1:1.9.1-2.el9
Event History
Frequently Asked Questions
What attacker access is indicated by the supplied severity vector?
The supplied CVSS vector indicates network-reachable exploitation with low attack complexity, no required privileges, and no user interaction. The stated impact is limited to availability; confidentiality and integrity impacts are not indicated.
Which package variants are included in this update?
The update covers rocky-linux/containernetworking-plugins, rocky-linux/containernetworking-plugins-debuginfo, and rocky-linux/containernetworking-plugins-debugsource.