Read the docs
Red Hat Security Advisory

RHSA-2026:16696

skopeo security update

Released 2026-05-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 5 records

TI-2025-41709 CVE-2025-68121 · GHSA-h355-32pf-p2xm

Unexpected session resumption in crypto/tls

Priority MEDIUM 51

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00902 Published 2026-02-05 Partial fix · 1.24.13, 1.25.7 +1 CWE-295
TI-2025-38128 CVE-2025-61726 · GHSA-gm9r-q53w-2gh4

Memory exhaustion in query parameter parsing in net/url

Priority MEDIUM 43

The net/url package does not set a limit on the number of query parameters in a query.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02292 Published 2026-01-28 Partial fix · 1.24.12, 1.25.6 CWE-770
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8

Go JOSE affect by a panic in JWE decryption

Priority MEDIUM 40

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-04-06 Partial fix · 4.1.4, 3.0.5 CWE-248
TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8

Incorrect parsing of IPv6 host literals in net/url

Priority MEDIUM 40

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00827 Published 2026-03-06 Partial fix · 1.25.8, 1.26.1 CWE-425