Moderate Security Vulnerability in Podman: Request Smuggling Issue
Summary
ALSA-2025:9144: Moderate: podman security update. Affects podman versions < 5:5.4.0-10.el9_6. Fixed in 5:5.4.0-10.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Podman is a tool that manages pods, container images, and containers, and is part of the libpod library. It is designed for applications that utilize container pods, a concept integral to Kubernetes. Podman allows users to run containers without requiring a daemon, making it lightweight and efficient. However, it has been found to be vulnerable to a security issue that could allow for request smuggling due to the acceptance of invalid chunked data.
Vulnerability Detail
The vulnerability identified as CVE-2025-22871 in Podman relates to the net/http package, where the tool improperly handles invalid chunked data. This flaw can lead to request smuggling attacks, where an attacker could manipulate the way requests are processed, potentially allowing unauthorized access or data leakage. The ramifications of this vulnerability could be severe, affecting the integrity and confidentiality of the data managed by Podman.
How To Fix
Minimum fixed version
5:5.4.0-10.el9_6
This is the first release that contains the fix.
sudo dnf update podmanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected features of Podman that rely on the net/http package until the update is applied. However, the best course of action is to apply the security update as soon as possible.
Conclusion
The identified vulnerability in Podman, CVE-2025-22871, poses a moderate security risk due to improper handling of chunked data. Users are strongly encouraged to update to the patched version to mitigate potential risks. Utilizing tools like Vulert can further enhance your security posture by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for podman →
FAQ
CVE-2025-22871 is a security vulnerability in Podman that allows for request smuggling due to improper handling of invalid chunked data in the net/http package.
This vulnerability could potentially allow attackers to manipulate requests, leading to unauthorized access or data leakage from your containers.
If an immediate update is not possible, avoid using the affected features of Podman that rely on the net/http package until the patch can be applied.
More details can be found on the CVE page for CVE-2025-22871, which outlines the impact and technical specifics of the vulnerability.
Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json, without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for podman.
