Every CVE Search/ Get API key

CVE-2025-11395

Podman: arbitrary file write when importing oci archive

5.5 MediumFix available

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.45%Up 0.3 points since Sep 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.5

Podman: arbitrary file write when importing oci archive

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Record
CVE-2025-11395
CVSS 3.1
5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-277
Updated
2026-11-02
EUVDEUVD-2025-210915 5.5

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Record
EUVD-2025-210915
CVSS 3.1
5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-6jv9-mhj9-v2h4 5.5

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load`...

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Record
GHSA-6jv9-mhj9-v2h4
CVSS 3.1
5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-277
Updated
2026-11-02
NVD 5.5

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Record
CVE-2025-11395
CVSS 3.1
5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-277
Updated
2026-11-02
OSVALPINE-CVE-2025-11395 5.5

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Record
ALPINE-CVE-2025-11395
CVSS 3.1
5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-03
OSVBELL-CVE-2025-11395 5.5
Record
BELL-CVE-2025-11395
CVSS 3.1
5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
Show 29 moreShow less
OSVDEBIAN-CVE-2025-11395 5.5

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Record
DEBIAN-CVE-2025-11395
CVSS 3.1
5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:70640 8.1

Red Hat Security Advisory: buildah security update

Record
RHSA-2026:70640
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:70641 8.1

Red Hat Security Advisory: skopeo security update

Record
RHSA-2026:70641
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:70640 8.1

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

  • buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

  • buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

  • buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

  • buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

  • buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:70640
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:70641 8.1

Important: skopeo security update

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them.

Security Fix(es):

  • skopeo: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

  • skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

  • skopeo: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

  • skopeo: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

  • skopeo: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:70641
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:88262 7.5

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

  • podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)

  • net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)

  • crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:88262
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:89761 7.5

Important: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

  • podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)

  • crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:89761
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:90362 7.5

Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)

  • crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:90362
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:90424 7.5

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

  • podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)

  • golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855)

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)

  • crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:90424
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:90462 7.5

Important: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

  • podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)

  • crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:90462
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:93464 5.5

Moderate: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:93464
CVSS 3.1
5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-03
OSVUBUNTU-CVE-2025-11395 5.5

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Record
UBUNTU-CVE-2025-11395
CVSS 3.1
5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVALSA-2026:70640 No score

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

  • buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
  • buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
  • buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
  • buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
  • buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:70640
Updated
2026-11-02
OSVALSA-2026:70641 No score

Important: skopeo security update

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them.

Security Fix(es):

  • skopeo: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
  • skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
  • skopeo: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
  • skopeo: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
  • skopeo: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:70641
Updated
2026-11-02
OSVALSA-2026:88262 No score

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

  • podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)
  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
  • crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:88262
Updated
2026-11-02
OSVALSA-2026:89761 No score

Important: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

  • podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)
  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:89761
Updated
2026-11-02
OSVALSA-2026:90362 No score

Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)
  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:90362
Updated
2026-11-02
OSVALSA-2026:90424 No score

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

  • podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)
  • golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855)
  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:90424
Updated
2026-11-02
OSVALSA-2026:90462 No score

Important: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

  • podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)
  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:90462
Updated
2026-11-02
OSVALSA-2026:93464 No score

Moderate: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:93464
Updated
2026-11-02
OSVAZL-103068 No score

CVE-2025-11395 affecting package buildah 1.43.1-3

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Record
AZL-103068
Updated
2026-11-02
OSVAZL-103079 No score

CVE-2025-11395 affecting package cri-o 1.30.1-1

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Record
AZL-103079
Updated
2026-11-02
OSVAZL-103086 No score

CVE-2025-11395 affecting package podman 5.6.1-10

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Record
AZL-103086
Updated
2026-11-02
OSVAZL-103137 No score

CVE-2025-11395 affecting package containerized-data-importer 1.62.0-9

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Record
AZL-103137
Updated
2026-11-02
OSVAZL-103224 No score

CVE-2025-11395 affecting package libcontainers-common 20240213-3

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Record
AZL-103224
Updated
2026-11-02
OSVAZL-103272 No score

CVE-2025-11395 affecting package skopeo 1.14.4-15

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman.

Record
AZL-103272
Updated
2026-11-02
OSVCLSA-2026-1792085312 No score

buildah: Fix of CVE-2025-11395

  • CVE-2025-11395: storage/pkg/archive, oci/archive: confine the extraction of a crafted tar archive and the reading of an extracted oci-archive to the destination
Record
CLSA-2026-1792085312
Updated
2026-11-02
OSVCLSA-2026-1792142544 No score

buildah: Fix of 2 CVEs

  • CVE-2025-11395: storage/pkg/archive, oci/archive: confine the extraction of a crafted tar archive and the reading of an extracted oci-archive to the destination
Record
CLSA-2026-1792142544
Updated
2026-11-02
OSVopenSUSE-SU-2026:12068-1 No score

podman-6.1.2-1.1 on GA media

These are all security issues fixed in the podman-6.1.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12068-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
podman
Alpine:v3.24
 before 5.8.8-r0
5.8.8-r0
buildah
AlmaLinux:9
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
buildah-tests
AlmaLinux:9
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
skopeo
AlmaLinux:9
 before 2:1.22.2-8.el9_8
2:1.22.2-8.el9_8
skopeo-tests
AlmaLinux:9
 before 2:1.22.2-8.el9_8
2:1.22.2-8.el9_8
buildah
AlmaLinux:10
 before 2:1.43.1-7.el10_2
2:1.43.1-7.el10_2
buildah-tests
AlmaLinux:10
 before 2:1.43.1-7.el10_2
2:1.43.1-7.el10_2
skopeo
AlmaLinux:10
 before 2:1.22.2-6.el10_2
2:1.22.2-6.el10_2
skopeo-tests
AlmaLinux:10
 before 2:1.22.2-6.el10_2
2:1.22.2-6.el10_2
podman
AlmaLinux:9
 before 6:5.8.2-8.el9_8
6:5.8.2-8.el9_8
Show 46 moreShow less
Affected packages
PackageAffectedFixed
podman-docker
AlmaLinux:9
 before 6:5.8.2-8.el9_8
6:5.8.2-8.el9_8
podman-plugins
AlmaLinux:9
 before 6:5.8.2-8.el9_8
6:5.8.2-8.el9_8
podman-remote
AlmaLinux:9
 before 6:5.8.2-8.el9_8
6:5.8.2-8.el9_8
podman-tests
AlmaLinux:9
 before 6:5.8.2-8.el9_8
6:5.8.2-8.el9_8
buildah
AlmaLinux:9
 before 2:1.43.4-2.el9_8
2:1.43.4-2.el9_8
buildah-tests
AlmaLinux:9
 before 2:1.43.4-2.el9_8
2:1.43.4-2.el9_8
skopeo
AlmaLinux:9
 before 2:1.22.2-9.el9_8
2:1.22.2-9.el9_8
skopeo-tests
AlmaLinux:9
 before 2:1.22.2-9.el9_8
2:1.22.2-9.el9_8
podman
AlmaLinux:10
 before 7:5.8.2-12.el10_2.alma.1
7:5.8.2-12.el10_2.alma.1
podman-docker
AlmaLinux:10
 before 7:5.8.2-12.el10_2.alma.1
7:5.8.2-12.el10_2.alma.1
podman-remote
AlmaLinux:10
 before 7:5.8.2-12.el10_2.alma.1
7:5.8.2-12.el10_2.alma.1
podman-tests
AlmaLinux:10
 before 7:5.8.2-12.el10_2.alma.1
7:5.8.2-12.el10_2.alma.1
buildah
Azure Linux:3
 through 1.43.1-3 None known
cri-o
Azure Linux:3
 through 1.30.1-1 None known
podman
Azure Linux:3
 through 5.6.1-10 None known
containerized-data-importer
Azure Linux:3
 through 1.62.0-9 None known
libcontainers-common
Azure Linux:3
 through 20240213-3 None known
skopeo
Azure Linux:3
 through 1.14.4-15 None known
podman
Alpaquita:stream
 4.5.1-r1 up to 6.1.3-r0
6.1.3-r0
skopeo
Alpaquita:stream
 1.13.0-r1 up to 1.24.1-r0
1.24.1-r0
buildah
TuxCare:AlmaLinux:9.6
 before 2:1.39.6-1.el9_6.tuxcare.els13
2:1.39.6-1.el9_6.tuxcare.els13
buildah-tests
TuxCare:AlmaLinux:9.6
 before 2:1.39.6-1.el9_6.tuxcare.els13
2:1.39.6-1.el9_6.tuxcare.els13
buildah
TuxCare:AlmaLinux:9.2
 before 2:1.39.6-1.el9_2.tuxcare.els13
2:1.39.6-1.el9_2.tuxcare.els13
buildah-tests
TuxCare:AlmaLinux:9.2
 before 2:1.39.6-1.el9_2.tuxcare.els13
2:1.39.6-1.el9_2.tuxcare.els13
podman
Debian:13
 All versions, plus listed versions
5.4.2+ds1-25.6.1+ds1-15.6.1+ds1-25.6.1+ds2-25.6.1+ds2-3
Show 22 moreShow less
5.6.2+ds1-15.6.2+ds1-25.6.2+ds1-35.6.2+ds1-3+exp15.6.2+ds1-45.7.0+ds2-15.7.0+ds2-25.7.0+ds2-35.8.0+ds1-15.8.1+ds1-15.8.1+ds1-25.8.1+ds1-35.8.2+ds1-15.8.2+ds1-25.8.2+ds1-35.8.3+ds1-15.8.4+ds1-15.8.4+ds1-25.8.6+ds1-15.8.6+ds1-25.8.6+ds1-36.1.1+ds1-1
 None known
podman
Debian:14
 All versions, plus listed versions
5.4.2+ds1-25.6.1+ds1-15.6.1+ds1-25.6.1+ds2-25.6.1+ds2-3
Show 22 moreShow less
5.6.2+ds1-15.6.2+ds1-25.6.2+ds1-35.6.2+ds1-3+exp15.6.2+ds1-45.7.0+ds2-15.7.0+ds2-25.7.0+ds2-35.8.0+ds1-15.8.1+ds1-15.8.1+ds1-25.8.1+ds1-35.8.2+ds1-15.8.2+ds1-25.8.2+ds1-35.8.3+ds1-15.8.4+ds1-15.8.4+ds1-25.8.6+ds1-15.8.6+ds1-25.8.6+ds1-36.1.1+ds1-1
 None known
buildah
Red Hat:enterprise_linux:9::appstream
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
buildah-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
buildah-debugsource
Red Hat:enterprise_linux:9::appstream
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
buildah-tests
Red Hat:enterprise_linux:9::appstream
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
buildah-tests-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
skopeo
Red Hat:enterprise_linux:9::appstream
 before 2:1.22.2-8.el9_8
2:1.22.2-8.el9_8
skopeo-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 2:1.22.2-8.el9_8
2:1.22.2-8.el9_8
skopeo-debugsource
Red Hat:enterprise_linux:9::appstream
 before 2:1.22.2-8.el9_8
2:1.22.2-8.el9_8
skopeo-tests
Red Hat:enterprise_linux:9::appstream
 before 2:1.22.2-8.el9_8
2:1.22.2-8.el9_8
buildah
Rocky Linux:9
 before 2:1.43.3-2.el9_8
2:1.43.3-2.el9_8
skopeo
Rocky Linux:9
 before 2:1.22.2-8.el9_8
2:1.22.2-8.el9_8
buildah
Rocky Linux:10
 before 2:1.43.1-7.el10_2
2:1.43.1-7.el10_2
skopeo
Rocky Linux:10
 before 2:1.22.2-6.el10_2
2:1.22.2-6.el10_2
podman
Rocky Linux:9
 before 6:5.8.2-8.el9_8
6:5.8.2-8.el9_8
buildah
Rocky Linux:9
 before 2:1.43.4-2.el9_8
2:1.43.4-2.el9_8
skopeo
Rocky Linux:9
 before 2:1.22.2-9.el9_8
2:1.22.2-9.el9_8
podman
Rocky Linux:10
 before 7:5.8.2-12.el10_2
7:5.8.2-12.el10_2
podman
Ubuntu:26.10
 All versions, plus listed versions
5.7.0+ds2-3build15.8.3+ds1-15.8.4+ds1-15.8.6+ds1-2
 None known
podman
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.4.2+ds1-25.7.0+ds2-35.7.0+ds2-3build1
 None known
podman
openSUSE:Tumbleweed
 before 6.1.2-1.1
6.1.2-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-11395 is a medium vulnerability (CVSS 5.5) in Red Hat Enterprise Linux 10, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in podman 5.8.8-r0.

References

Show 100 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open