{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-39829: fix DoS in vendored golang.org/x/crypto/ssh public-key\n parsing (cap RSA moduli at 8192 bits, validate DSA parameters per\n FIPS 186-2); affects both el9_2 and el9_6\n- CVE-2026-32281: rebuild el9_6 against golang >= 1.25.7-1.el9_6.tuxcare.els7\n to fix DoS in crypto/x509 policy validation (Go >= 1.24 only; el9_2 builds\n with Go 1.22.9 and is not affected)", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1782812169", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1782812169" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.6esu/advisories/2026/clsa-2026_1782812169.json" } ], "tracking": { "current_release_date": "2026-06-30T09:37:07Z", "generator": { "date": "2026-06-30T09:37:07Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1782812169", "initial_release_date": "2026-06-30T09:37:07Z", "revision_history": [ { "date": "2026-06-30T09:37:07Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "buildah: Fix of 2 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AlmaLinux 9.6", "product": { "name": "AlmaLinux 9.6", "product_id": "AlmaLinux-9.6", "product_identification_helper": { "cpe": "cpe:2.3:o:almalinux:almalinux:9.6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "AlmaLinux" } ], "category": "vendor", "name": "AlmaLinux OS Foundation" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Rocky Linux 9.6", "product": { "name": "Rocky Linux 9.6", "product_id": "Rocky Linux-9.6", "product_identification_helper": { "cpe": "cpe:2.3:o:resf:rocky_linux:9.6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Rocky Linux" } ], "category": "vendor", "name": "Rocky Linux" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "product": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "product_id": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/buildah-tests@1.39.6-1.el9_6.tuxcare.els9?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "product": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "product_id": "buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/buildah@1.39.6-1.el9_6.tuxcare.els9?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "product": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "product_id": "buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/buildah@1.39.6-1.el9_6.tuxcare.els8?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "product": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "product_id": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/buildah-tests@1.39.6-1.el9_6.tuxcare.els8?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "product": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "product_id": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/buildah-tests@1.39.6-1.el9_6.tuxcare.els7?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "product": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "product_id": "buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/buildah@1.39.6-1.el9_6.tuxcare.els7?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "product": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "product_id": "buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/buildah@1.39.6-1.el9_6.tuxcare.els6?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "product": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "product_id": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/buildah-tests@1.39.6-1.el9_6.tuxcare.els6?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "product": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "product_id": "buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/buildah@1.39.6-1.el9_6.tuxcare.els3?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "product": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "product_id": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/buildah-tests@1.39.6-1.el9_6.tuxcare.els3?arch=x86_64&epoch=2" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64" }, "product_reference": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64" }, "product_reference": "buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64" }, "product_reference": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64" }, "product_reference": "buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64" }, "product_reference": "buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64" }, "product_reference": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64" }, "product_reference": "buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64" }, "product_reference": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64" }, "product_reference": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64" }, "product_reference": "buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64" }, "product_reference": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64" }, "product_reference": "buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64" }, "product_reference": "buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64" }, "product_reference": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64" }, "product_reference": "buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64" }, "product_reference": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64" }, "product_reference": "buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64" }, "product_reference": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64" }, "product_reference": "buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64" }, "product_reference": "buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-32281", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "description", "text": "Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64" ], "known_affected": [ "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-32281" }, { "category": "external", "summary": "https://go.dev/cl/758061", "url": "https://go.dev/cl/758061" }, { "category": "external", "summary": "https://go.dev/issue/78281", "url": "https://go.dev/issue/78281" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-4946", "url": "https://pkg.go.dev/vuln/GO-2026-4946" } ], "release_date": "2026-04-08T02:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-06-30T09:36:12.995574Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1782812169", "product_ids": [ "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1782812169" }, { "category": "none_available", "date": "2026-04-08T02:16:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-39829", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "notes": [ { "category": "description", "text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64" ], "known_affected": [ "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-39829" } ], "release_date": "2026-05-22T02:31:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-06-30T09:36:12.995574Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1782812169", "product_ids": [ "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1782812169" }, { "category": "none_available", "date": "2026-05-22T02:31:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els8.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els6.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els7.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "AlmaLinux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "Rocky Linux-9.6:buildah-2:1.39.6-1.el9_6.tuxcare.els9.x86_64", "Rocky Linux-9.6:buildah-tests-2:1.39.6-1.el9_6.tuxcare.els9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }