SB20260731118 - Red Hat Enterprise Linux 9 update for podman
Published: July 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2026-34986)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in JWE decryption in key_wrap.go when processing a JWE object with a key wrapping algorithm and an empty encrypted_key field. A remote attacker can send a specially crafted JWE object to cause a denial of service.
The issue is reachable through ParseEncrypted(), ParseEncryptedJSON(), or ParseEncryptedCompact() followed by Decrypt(), and applications are affected only if accepted key algorithms include key wrapping algorithms.
2) Input validation error (CVE-ID: CVE-2026-32281)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in Certificate.Verify in crypto/x509 when validating certificate chains containing a very large number of policy mappings. A remote attacker can present a specially crafted certificate chain to cause a denial of service.
This only affects validation of otherwise trusted certificate chains issued by a root CA in the VerifyOptions.Roots CertPool or in the system certificate pool.
3) Dependency on vulnerable third-party component (CVE-ID: CVE-2026-32283)
CWE-ID: CWE-1395 - Dependency on Vulnerable Third-Party Component
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to dependency on a vulnerable third-party component in the Go standard library used by Fleet Server when handling network input. A remote attacker can send a specially crafted payload to cause a denial of service.
All configurations are affected.
4) Resource exhaustion (CVE-ID: CVE-2026-32280)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the Certificate.Verify chain-building logic in crypto/x509 when processing a large number of intermediate certificates supplied through VerifyOptions.Intermediates. A remote attacker can provide a large number of intermediate certificates to cause a denial of service.
This affects both direct users of crypto/x509 and users of crypto/tls.
Remediation
Install update from vendor's website.