RLSA-2026:98451: Important: runc security update
The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.
Security Fix(es):
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/runcto a version that resolves this vulnerability.Fixed in 4:1.4.2-3.el9_8
Event History
Frequently Asked Questions
What impact can successful exploitation have?
The issue can cause a denial of service through quadratic complexity in URL path resolution. The supplied CVSS vector indicates network reachability, low attack complexity, no required privileges or user interaction, and impact limited to availability.
Which deployments should be prioritized for remediation?
Prioritize Rocky Linux systems running runc where container workloads or related components may process attacker-controlled URL paths. The advisory identifies rocky-linux/runc as the affected software but does not provide affected or fixed package versions.