Red Hat Security Advisory

RHSA-2026:88262

buildah security update

Released 2026-10-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) buildah-2:1.43.1-7.el10_2, buildah-tests-2:1.43.1-7.el10_2

Fixes 4 records

TI-2026-69828 CVE-2026-78669

Excessive CPU use from repeated window changes in Go net/http

MEDIUM 40

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00847 Published 2026-10-08 Partial fix · 1.26.9, 1.27.2 +1 CWE-405

TI-2026-69827 CVE-2026-78667 · GHSA-f4xw-m386-m277

Excessive CPU use in Go net/http when parsing Range headers

MEDIUM 40

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-10-08 Partial fix · 1.26.9, 1.27.2 CWE-770

TI-2026-78632 CVE-2026-111943

Go crypto/x509 accepts known compromised intermediate certificates

LOW 32

On most platforms, Go uses the given system root certificates.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00396 Published 2026-10-21 Partial fix · 1.26.10, 1.27.3 CWE-299

TI-2025-10436 CVE-2025-11395 · GHSA-6jv9-mhj9-v2h4

Podman: arbitrary file write when importing oci archive

LOW 25

A flaw was found in Podman.

CVSS 3.1MEDIUM 5.5 Adjacent network Low privileges No interaction EPSS 0.00449 Published 2026-09-15 Partial fix · 2:1.43.1-7.el10_2, 2:1.22.2-6.el10_2 +6 CWE-277