RLSA-2026:98447: Important: podman security update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/podmanto a version that resolves this vulnerability.Fixed in 6:5.8.5-3.el9_9 - Upgrade
Upgrade
rocky-linux/podman-debuginfoto a version that resolves this vulnerability.Fixed in 6:5.8.5-3.el9_9 - Upgrade
Upgrade
rocky-linux/podman-debugsourceto a version that resolves this vulnerability.Fixed in 6:5.8.5-3.el9_9 - Upgrade
Upgrade
rocky-linux/podman-pluginsto a version that resolves this vulnerability.Fixed in 6:5.8.5-3.el9_9 - Upgrade
Upgrade
rocky-linux/podman-plugins-debuginfoto a version that resolves this vulnerability.Fixed in 6:5.8.5-3.el9_9 - Upgrade
Upgrade
rocky-linux/podman-remoteto a version that resolves this vulnerability.Fixed in 6:5.8.5-3.el9_9 - Upgrade
Upgrade
rocky-linux/podman-remote-debuginfoto a version that resolves this vulnerability.Fixed in 6:5.8.5-3.el9_9 - Upgrade
Upgrade
rocky-linux/podman-teststo a version that resolves this vulnerability.Fixed in 6:5.8.5-3.el9_9 - Upgrade
Upgrade
rocky-linux/podman-tests-debuginfoto a version that resolves this vulnerability.Fixed in 6:5.8.5-3.el9_9 - Upgrade
Upgrade
rocky-linux/podman-dockerto a version that resolves this vulnerability.Fixed in 6:5.8.5-3.el9_9
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What access does an attacker need according to the advisory’s severity vector?
The supplied vector indicates network access, low attack complexity, no required privileges, and required user interaction. It indicates high confidentiality and integrity impact, with no availability impact.
Which installed package variants are in scope for this update?
The advisory lists podman, podman-debuginfo, podman-debugsource, podman-plugins, podman-plugins-debuginfo, podman-remote, podman-remote-debuginfo, and podman-tests for Rocky Linux. Systems with any of these installed should evaluate and apply the corresponding update.