RLSA-2026:98403: Important: oci-delta security, bug fix, and enhancement update
Creates and applies delta files between OCI image archives for bootc systems. Delta files are significantly smaller than full OCI archives because they exclude layers already present on the target system and use binary diffs (tar-diff) for changed layers.
Security Fix(es):
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
Bug Fix(es) and Enhancement(s):
Update oci-delta to v0.3.1 for Rocky Linux 10.3.z async release (JIRA:Rocky Linux-290036)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/oci-deltato a version that resolves this vulnerability.Fixed in 0:0.3.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/oci-delta-debuginfoto a version that resolves this vulnerability.Fixed in 0:0.3.1-1.el10_3.2 - Upgrade
Upgrade
rocky-linux/oci-delta-debugsourceto a version that resolves this vulnerability.Fixed in 0:0.3.1-1.el10_3.2 - Upgrade
Upgrade
oci-deltato a version that resolves this vulnerability.Fixed in v0.3.1
Event History
Frequently Asked Questions
What access does an attacker need according to the advisory’s severity vector?
The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the expected security impact?
The severity vector indicates a high availability impact, with no confidentiality or integrity impact. The listed Go issues are both denial-of-service vulnerabilities.
Which package variants should be reviewed for this update?
Review rocky-linux/oci-delta, rocky-linux/oci-delta-debuginfo, and rocky-linux/oci-delta-debugsource. The update includes oci-delta version 0.3.1 for the Rocky Linux 10.3.z async release.