{"id":"CVE-2025-11395","aliases":["ALPINE-CVE-2025-11395","ALSA-2026:70640","ALSA-2026:70641","ALSA-2026:88262","ALSA-2026:89761","ALSA-2026:90362","ALSA-2026:90424","ALSA-2026:90462","ALSA-2026:93464","AZL-103068","AZL-103079","AZL-103086","AZL-103137","AZL-103224","AZL-103272","BELL-CVE-2025-11395","CLSA-2026-1792085312","CLSA-2026-1792142544","DEBIAN-CVE-2025-11395","EUVD-2025-210915","GHSA-6jv9-mhj9-v2h4","RHSA-2026:70640","RHSA-2026:70641","RLSA-2026:70640","RLSA-2026:70641","RLSA-2026:88262","RLSA-2026:89761","RLSA-2026:90362","RLSA-2026:90424","RLSA-2026:90462","RLSA-2026:93464","UBUNTU-CVE-2025-11395","openSUSE-SU-2026:12068-1"],"status":"published","title":"Podman: arbitrary file write when importing oci archive","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00449,"percentile":0.39497,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-277"],"published":"2026-09-15T22:59:03Z","modified":"2026-11-11T22:54:47Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"podman","fixed_in":["5.8.8-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"podman","fixed_in":["7:5.8.2-12.el10_2.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"podman-docker","fixed_in":["7:5.8.2-12.el10_2.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"podman-remote","fixed_in":["7:5.8.2-12.el10_2.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"podman-tests","fixed_in":["7:5.8.2-12.el10_2.alma.1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"podman","fixed_in":["6.1.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"skopeo","fixed_in":["1.24.1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"buildah","fixed_in":["2:1.39.6-1.el9_6.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"buildah-tests","fixed_in":["2:1.39.6-1.el9_6.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah","fixed_in":["2:1.39.6-1.el9_2.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah-tests","fixed_in":["2:1.39.6-1.el9_2.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"podman","fixed_in":["7:5.8.2-12.el10_2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.8-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.2-8.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.2-8.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.1-7.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.1-7.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.2-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.2-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.8.2-8.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.8.2-8.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.8.2-8.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.8.2-8.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.8.2-8.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.4-2.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.4-2.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.2-9.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.2-9.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.8.2-12.el10_2.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.8.2-12.el10_2.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.8.2-12.el10_2.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.8.2-12.el10_2.alma.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.43.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.6.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.62.0-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libcontainers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240213-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.14.4-15"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.1-r1"},{"fixed":"6.1.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0-r1"},{"fixed":"1.24.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.6-1.el9_6.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.6-1.el9_6.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.6-1.el9_2.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.6-1.el9_2.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+ds1-2","5.6.1+ds1-1","5.6.1+ds1-2","5.6.1+ds2-2","5.6.1+ds2-3","5.6.2+ds1-1","5.6.2+ds1-2","5.6.2+ds1-3","5.6.2+ds1-3+exp1","5.6.2+ds1-4","5.7.0+ds2-1","5.7.0+ds2-2","5.7.0+ds2-3","5.8.0+ds1-1","5.8.1+ds1-1","5.8.1+ds1-2","5.8.1+ds1-3","5.8.2+ds1-1","5.8.2+ds1-2","5.8.2+ds1-3","5.8.3+ds1-1","5.8.4+ds1-1","5.8.4+ds1-2","5.8.6+ds1-1","5.8.6+ds1-2","5.8.6+ds1-3","6.1.1+ds1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+ds1-2","5.6.1+ds1-1","5.6.1+ds1-2","5.6.1+ds2-2","5.6.1+ds2-3","5.6.2+ds1-1","5.6.2+ds1-2","5.6.2+ds1-3","5.6.2+ds1-3+exp1","5.6.2+ds1-4","5.7.0+ds2-1","5.7.0+ds2-2","5.7.0+ds2-3","5.8.0+ds1-1","5.8.1+ds1-1","5.8.1+ds1-2","5.8.1+ds1-3","5.8.2+ds1-1","5.8.2+ds1-2","5.8.2+ds1-3","5.8.3+ds1-1","5.8.4+ds1-1","5.8.4+ds1-2","5.8.6+ds1-1","5.8.6+ds1-2","5.8.6+ds1-3","6.1.1+ds1-1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.2-8.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.2-8.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.2-8.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.2-8.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.3-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.2-8.el9_8"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:10","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.1-7.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:10","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.2-6.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6:5.8.2-8.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.43.4-2.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.22.2-9.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.8.2-12.el10_2"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.0+ds2-3build1","5.8.3+ds1-1","5.8.4+ds1-1","5.8.6+ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.2+ds1-2","5.7.0+ds2-3","5.7.0+ds2-3build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.2-1.1"}]}],"bundled":3}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.8 extended update support"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift dev spaces"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:70640","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70641","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:88262","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:89761","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90362","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90424","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90462","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:93464","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:99093","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11395","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2402034","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11395","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6jv9-mhj9-v2h4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-11395","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15789","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56855","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515839","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-70640.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-70641.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111943","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78667","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78669","tags":["report"]},{"url":"https://bugzilla.redhat.com/2548334","tags":["report"]},{"url":"https://bugzilla.redhat.com/2548344","tags":["report"]},{"url":"https://bugzilla.redhat.com/2556068","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-88262.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-89761.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-90362.html","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2528050","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-90424.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-90462.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-93464.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-11395","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792085312.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792142544.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30631","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-11395","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70640.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11395","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503742","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15789","tags":["advisory"]},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-g2h8-426c-7976","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56855","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56855","tags":["advisory"]},{"url":"https://go.dev/cl/826524","tags":["article"]},{"url":"https://go.dev/issue/81317","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/1y3fb2np35U","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6355","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70641.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:70640","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:70641","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:88262","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548334","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556068","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:89761","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:90362","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:90424","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:90462","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:93464","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-11395","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79699","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-11395","title":"Podman: arbitrary file write when importing oci archive","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","status":"published","published":"2026-09-15T22:59:03.366Z","modified":"2026-11-11T22:54:47.29Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-277"],"updated_at":"2026-11-11T23:34:19.354464Z"}],"euvd":[{"id":"EUVD-2025-210915","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","status":"published","published":"2026-09-15T22:59:03Z","modified":"2026-11-11T22:54:47Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-12T00:31:11.846176Z"}],"ghsa":[{"id":"GHSA-6jv9-mhj9-v2h4","title":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load`...","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","status":"published","published":"2026-09-16T00:31:32Z","modified":"2026-11-12T00:32:55Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-277"],"updated_at":"2026-11-12T00:37:18.265111Z"}],"nvd":[{"id":"CVE-2025-11395","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","status":"published","published":"2026-09-15T23:16:59.933Z","modified":"2026-11-11T23:17:09Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-277"],"updated_at":"2026-11-12T01:27:01.15437Z"}],"osv":[{"id":"ALPINE-CVE-2025-11395","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","status":"published","published":"2026-09-15T23:16:59.933Z","modified":"2026-11-03T06:33:00.041320167Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"BELL-CVE-2025-11395","status":"published","published":"2026-09-20T06:04:11.734433Z","modified":"2026-10-08T07:15:06.54699088Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"DEBIAN-CVE-2025-11395","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","status":"published","published":"2026-09-15T23:16:59.933Z","modified":"2026-11-12T09:47:34.200629849Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-12T10:16:30.501395Z"},{"id":"RHSA-2026:70640","title":"Red Hat Security Advisory: buildah security update","status":"published","published":"2026-09-24T10:15:03Z","modified":"2026-10-20T10:14:42Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:70641","title":"Red Hat Security Advisory: skopeo security update","status":"published","published":"2026-09-24T10:15:04Z","modified":"2026-10-20T10:14:43Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:70640","title":"Important: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.\n\nSecurity Fix(es):\n\n* buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n\n* buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n\n* buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n\n* buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n\n* buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-24T18:05:00.461776Z","modified":"2026-09-24T18:24:42.165328695Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:70641","title":"Important: skopeo security update","description":"Command line utility to inspect images and repositories directly on Docker registries without the need to pull them.\n\nSecurity Fix(es):\n\n* skopeo: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n\n* skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n\n* skopeo: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n\n* skopeo: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n\n* skopeo: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-24T18:05:00.461776Z","modified":"2026-09-24T18:24:42.192944411Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:88262","title":"Important: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. \n\nSecurity Fix(es):\n\n* podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n\n* net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n\n* net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)\n\n* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-23T12:11:02.998013Z","modified":"2026-10-23T12:45:02.518854984Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:89761","title":"Important: skopeo security update","description":"The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. \n\nSecurity Fix(es):\n\n* podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n\n* net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n\n* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-27T12:08:55.409043Z","modified":"2026-10-27T12:30:04.135528314Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:90362","title":"Important: podman security update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.\n\nSecurity Fix(es):\n\n* podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n\n* net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n\n* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:04:09.468138Z","modified":"2026-10-29T12:30:04.193607977Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:90424","title":"Important: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. \n\nSecurity Fix(es):\n\n* podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n\n* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855)\n\n* net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n\n* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:04:09.468138Z","modified":"2026-10-29T12:30:03.192906069Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:90462","title":"Important: skopeo security update","description":"The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. \n\nSecurity Fix(es):\n\n* podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n\n* net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n\n* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:04:09.468138Z","modified":"2026-10-29T12:30:03.375979885Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:93464","title":"Moderate: podman security update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.\n\nSecurity Fix(es):\n\n* podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-03T12:10:03.560067Z","modified":"2026-11-03T12:30:02.48633491Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T13:02:16.068655Z"},{"id":"UBUNTU-CVE-2025-11395","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","status":"published","published":"2026-09-15T23:16:00Z","modified":"2026-10-17T12:56:47.818148673Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"ALSA-2026:70640","title":"Important: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.  \n\nSecurity Fix(es):  \n\n  * buildah: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n  * buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n  * buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n  * buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n  * buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-23T00:00:00Z","modified":"2026-10-29T11:42:20.205890205Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:70641","title":"Important: skopeo security update","description":"Command line utility to inspect images and repositories directly on Docker registries without the need to pull them.  \n\nSecurity Fix(es):  \n\n  * skopeo: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n  * skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n  * skopeo: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n  * skopeo: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n  * skopeo: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-23T00:00:00Z","modified":"2026-10-29T11:42:21.714571063Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:88262","title":"Important: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.   \n\nSecurity Fix(es):  \n\n  * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)\n  * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-22T00:00:00Z","modified":"2026-10-29T11:31:02.735485636Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:89761","title":"Important: skopeo security update","description":"The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.   \n\nSecurity Fix(es):  \n\n  * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:31:03.695642235Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:90362","title":"Important: podman security update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  \n\nSecurity Fix(es):  \n\n  * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:32:32.79603789Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:90424","title":"Important: buildah security update","description":"The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.   \n\nSecurity Fix(es):  \n\n  * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n  * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855)\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:32:32.891147014Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:90462","title":"Important: skopeo security update","description":"The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.   \n\nSecurity Fix(es):  \n\n  * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n  * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)\n  * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:32:32.792829602Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:93464","title":"Moderate: podman security update","description":"The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  \n\nSecurity Fix(es):  \n\n  * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-02T00:00:00Z","modified":"2026-11-02T10:30:02.097688326Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-103068","title":"CVE-2025-11395 affecting package buildah 1.43.1-3","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","status":"published","published":"2026-09-15T23:16:59Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103079","title":"CVE-2025-11395 affecting package cri-o 1.30.1-1","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","status":"published","published":"2026-09-15T23:16:59Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103086","title":"CVE-2025-11395 affecting package podman 5.6.1-10","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","status":"published","published":"2026-09-15T23:16:59Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103137","title":"CVE-2025-11395 affecting package containerized-data-importer 1.62.0-9","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","status":"published","published":"2026-09-15T23:16:59Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"AZL-103224","title":"CVE-2025-11395 affecting package libcontainers-common 20240213-3","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","status":"published","published":"2026-09-15T23:16:59Z","modified":"2026-09-21T05:34:22Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"AZL-103272","title":"CVE-2025-11395 affecting package skopeo 1.14.4-15","description":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.","status":"published","published":"2026-09-15T23:16:59Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"CLSA-2026-1792085312","title":"buildah: Fix of CVE-2025-11395","description":"- CVE-2025-11395: storage/pkg/archive, oci/archive: confine the extraction of a\n  crafted tar archive and the reading of an extracted oci-archive to the destination","status":"published","published":"2026-10-15T17:28:41Z","modified":"2026-10-26T09:31:36.611906524Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792142544","title":"buildah: Fix of 2 CVEs","description":"- CVE-2025-11395: storage/pkg/archive, oci/archive: confine the extraction of a\n  crafted tar archive and the reading of an extracted oci-archive to the destination","status":"published","published":"2026-10-21T23:07:32Z","modified":"2026-10-26T09:30:48.518333062Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"openSUSE-SU-2026:12068-1","title":"podman-6.1.2-1.1 on GA media","description":"These are all security issues fixed in the podman-6.1.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-07T17:23:11.380006842Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}