Most recent entries from all

fkie_cve-2026-15789

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.

RHSA-2026:51065 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

github.com/moby/buildkit: BuildKit: Information Disclosure via Improper Handling of NTFS Directory Junctions buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerability golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input github.com/moby/buildkit: BuildKit: File escape vulnerability allows unauthorized file modification

RHSA-2026:70640 — Red Hat Security Advisory: buildah security update

podman: Arbitrary file write when importing OCI archive buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerability encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages html/template: golang: Go html/template: Cross-Site Scripting via pathological input net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

RLSA-2026:70640 — Important: buildah security update

Affected: Rocky Linux:9: buildah

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

* buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

* buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

* buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

* buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

* buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.