Most recent entries from all

fkie_cve-2025-11395

2026-09-30T12:00:24.705642+00:00

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

GHSA-6jv9-mhj9-v2h4

2026-09-30T12:00:24.705803+00:00

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

RHSA-2026:70640 — Red Hat Security Advisory: buildah security update

2026-09-30T12:00:24.705840+00:00

podman: Arbitrary file write when importing OCI archive buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerability encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages html/template: golang: Go html/template: Cross-Site Scripting via pathological input net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

RLSA-2026:70640 — Important: buildah security update

2026-09-30T12:00:24.705923+00:00

Affected: Rocky Linux:9: buildah

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

* buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

* buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

* buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

* buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

* buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2025-11395

2026-09-30T12:00:24.705993+00:00

Affected: Ubuntu:26.04:LTS: podman

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.