Red Hat Security Advisory

RHSA-2026:33722

container-tools:rhel8 security, bug fix, and enhancement update

Released 2026-06-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+24321+617e8352.src::container-tools:rhel8, buildah-2:1.33.14-3.module+el8.10.0+24321+617e8352.aarch64::container-tools:rhel8, buildah-2:1.33.14-3.module+el8.10.0+24321+617e8352.ppc64le::container-tools:rhel8 +47

Fixes 5 records

TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8

Go JOSE affect by a panic in JWE decryption

MEDIUM 40

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-04-06 Partial fix · 4.1.4, 3.0.5 CWE-248

TI-2026-24812 CVE-2026-32283 · GHSA-jrg3-gfjw-hm96

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

MEDIUM 40

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00632 Published 2026-04-08 Partial fix · 1.25.9, 1.26.2 CWE-770

TI-2026-24809 CVE-2026-32280 · GHSA-m4pr-4j3g-9v7v

Unexpected work during chain building in crypto/x509

MEDIUM 40

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00626 Published 2026-04-08 Partial fix · 1.25.9, 1.26.2 CWE-770

TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8

Incorrect parsing of IPv6 host literals in net/url

MEDIUM 40

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00827 Published 2026-03-06 Partial fix · 1.25.8, 1.26.1 CWE-425

TI-2026-24810 CVE-2026-32281 · GHSA-gjvh-7jh8-7xhm

Inefficient policy validation in crypto/x509

LOW 39

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00361 Published 2026-04-08 Partial fix · 1.25.9, 1.26.2 CWE-295