RHSA-2026:69961HighCVSS 8.1

Red Hat Security Advisory: podman security update

Published
September 22, 2026
Last Modified
October 5, 2026

🔗 CVE IDs covered (9)

CVE-2026-56862 →CVE-2026-17106 →CVE-2026-19730 →CVE-2026-39830 →CVE-2026-56858 →CVE-2026-33818 →CVE-2026-56853 →CVE-2026-56859 →CVE-2026-56860 →

📋 Description

CVE-2026-17106 — github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction CVE-2026-19730 — podman: podman: Quadlet install --replace non-truncating write retains removed host-access directives CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

🎯 Affected products39

  • Red Hat Enterprise Linux AppStream (v. 9)
  • podman-6:5.8.2-7.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-6:5.8.2-7.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-6:5.8.2-7.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-6:5.8.2-7.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-6:5.8.2-7.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-debuginfo-6:5.8.2-7.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-debuginfo-6:5.8.2-7.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-debuginfo-6:5.8.2-7.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-debuginfo-6:5.8.2-7.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-debugsource-6:5.8.2-7.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-debugsource-6:5.8.2-7.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-debugsource-6:5.8.2-7.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-debugsource-6:5.8.2-7.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-docker-6:5.8.2-7.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-plugins-6:5.8.2-7.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-plugins-6:5.8.2-7.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-plugins-6:5.8.2-7.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-plugins-6:5.8.2-7.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-plugins-debuginfo-6:5.8.2-7.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-plugins-debuginfo-6:5.8.2-7.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-plugins-debuginfo-6:5.8.2-7.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-plugins-debuginfo-6:5.8.2-7.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-remote-6:5.8.2-7.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-remote-6:5.8.2-7.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-remote-6:5.8.2-7.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-remote-6:5.8.2-7.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-remote-debuginfo-6:5.8.2-7.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-remote-debuginfo-6:5.8.2-7.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • podman-remote-debuginfo-6:5.8.2-7.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +9 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, avoid processing tar archives from untrusted sources. When handling archives from potentially untrusted origins, ensure that the extraction process is executed with the least privileges necessary to limit the impact of any arbitrary file write attempts. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (11)