VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/containers/buildah: vulnerability history, versions and safety

github.com/containers/buildah is a package in the Go ecosystem. Vulert records 20 vulnerabilities for it across 120 releases, from May 2021 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
20 vulnerabilities recorded H4 M5 U11
i
1 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
2 in the last 12 months

Most recent disclosure 27 Jul 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/containers/buildah vulnerabilities

Vulert verdict on github.com/containers/buildah v1.43.5 i

Updated on 23 Oct 2026

Action needed: v1.43.5 has 16 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 45/100
  • Security Some issues to review
  • Maintenance Deprecated
  • Popularity Key ecosystem project
  • Community Moderate

The registry marks the latest release as deprecated, which caps this score.

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v1.43.5 — affected i
  • Vulnerabilities on record 20 over 5 years · 2 in the last year i
  • Latest disclosure 27 Jul 2026 i
  • Highest CVSS 8.8 i
  • With no published fix 1 i
  • Stars 9,136 i
  • OpenSSF scorecard 5/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/containers/buildah, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.43.5 12 Oct 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.43.4 15 Sep 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.43.3 04 Aug 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.43.2 29 May 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.29.8 05 May 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.26.11 01 May 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.33.15 29 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.39.9 24 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260417143350-b5e78888f9bb 17 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260417143350-b5e78888f9bb 17 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260417103105-4e43fa8d9e07 17 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260417103105-4e43fa8d9e07 17 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.41.9 16 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260416210417-1afc7f4ab80e 16 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260416210417-1afc7f4ab80e 16 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260416185214-b2e419be6a3b 16 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260416185214-b2e419be6a3b 16 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260416142250-c82f174c06f5 16 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260416142250-c82f174c06f5 16 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260415193254-0d712f17375a 15 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260415193254-0d712f17375a 15 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260414161410-bf147ac4a3dc 14 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260414161410-bf147ac4a3dc 14 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260413203911-09b1c9dc537a 13 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260413203911-09b1c9dc537a 13 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260410210520-8cc6cbf11193 10 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260410210520-8cc6cbf11193 10 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260409175208-07b4cbb9edc7 09 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260409175208-07b4cbb9edc7 09 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260408175300-453a5ec295bf 08 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260408175300-453a5ec295bf 08 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.43.1 08 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260403205314-135b7f6e74f6 03 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260403205314-135b7f6e74f6 03 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260403194259-0f6b722a45dd 03 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260403194259-0f6b722a45dd 03 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260402170000-2bc4f4cecaff 02 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260402170000-2bc4f4cecaff 02 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260402004429-31315b34a893 02 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260402004429-31315b34a893 02 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260401181947-926a3eb94e1b 01 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260401181947-926a3eb94e1b 01 Apr 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260331160441-870e1aa72900 31 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260331160441-870e1aa72900 31 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260331024521-b472b65b5d85 31 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260331024521-b472b65b5d85 31 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260324113009-3b9dbdfd2248 24 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260324113009-3b9dbdfd2248 24 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260323182602-1ba7d5c117ed 23 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260323182602-1ba7d5c117ed 23 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260320141247-85f2cdc00ae4 20 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260320141247-85f2cdc00ae4 20 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260319154954-c9b944cbe5b3 19 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260319154954-c9b944cbe5b3 19 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260318164928-eb9c9b9d2fc8 18 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260318164928-eb9c9b9d2fc8 18 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260318135817-502aa2450478 18 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260316135125-09917c48eb3b 16 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260316135125-09917c48eb3b 16 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260312183251-79074e897647 12 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260312183251-79074e897647 12 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260312134952-a72854b50884 12 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260311200924-386f3066ca73 11 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260311200924-386f3066ca73 11 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260311183646-08d69ffa0278 11 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260311183646-08d69ffa0278 11 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260311182349-6672372ac30c 11 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260311181617-e30f5b803232 11 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260310123217-5974554c108c 10 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260310123217-5974554c108c 10 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260306163222-547feda8ed38 06 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260306163222-547feda8ed38 06 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260306094854-c86654bf193f 06 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260304145431-df33346beb03 04 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260304145431-df33346beb03 04 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260303210556-a162fb4002f8 03 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260303210556-a162fb4002f8 03 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260302213319-889cef3f1914 02 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260302213319-889cef3f1914 02 Mar 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260227185231-b15ab65150a7 27 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260227185231-b15ab65150a7 27 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260227161704-a064fc3cb3e0 27 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260227161704-a064fc3cb3e0 27 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260226104721-b2e3d9e695d6 26 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260226104721-b2e3d9e695d6 26 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260225223202-58482a872320 25 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260225223202-58482a872320 25 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260225221757-824788569507 25 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260225161907-f20fc42af637 25 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260225161907-f20fc42af637 25 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260218211440-c97d402ccd8d 18 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260218211440-c97d402ccd8d 18 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260216192603-e473f9d26ec6 16 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260216192603-e473f9d26ec6 16 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260216173239-f9b6a4bc1d5e 16 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260216173239-f9b6a4bc1d5e 16 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260213124905-9f379c4e1418 13 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260213124905-9f379c4e1418 13 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260212191824-e27dd2f1563a 12 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v1.42.1-0.20260212191824-e27dd2f1563a 12 Feb 2026 H2 M4 U10 Apache-2.0 Yes Details →
v0.0.0-20260209160628-0e32de077a52 09 Feb 2026 H2 M4 U10 — Yes Details →
v0.0.0-20260209142806-32a99170dee5 09 Feb 2026 H2 M4 U10 — Yes Details →
v1.42.1-0.20260209142806-32a99170dee5 09 Feb 2026 H2 M4 U10 — Yes Details →
v1.43.0 05 Feb 2026 H2 M4 U10 — Yes Details →
v0.0.0-20260202133413-3468444af57e 02 Feb 2026 H2 M4 U10 — Yes Details →
v1.42.1-0.20260202133413-3468444af57e 02 Feb 2026 H2 M4 U10 — Yes Details →
v0.0.0-20260129233826-1d16a5d4c63a 29 Jan 2026 H2 M4 U10 — Yes Details →
v1.42.1-0.20260129233826-1d16a5d4c63a 29 Jan 2026 H2 M4 U10 — Yes Details →
v0.0.0-20260127204841-a64396050c5b 27 Jan 2026 H2 M4 U10 — Yes Details →
v1.42.1-0.20260127204841-a64396050c5b 27 Jan 2026 H2 M4 U10 — Yes Details →
v0.0.0-20260126144005-964d45f717ce 26 Jan 2026 H2 M4 U10 — Yes Details →
v1.42.1-0.20260126144005-964d45f717ce 26 Jan 2026 H2 M4 U10 — Yes Details →
v0.0.0-20260123225158-b9666dca6178 23 Jan 2026 H2 M4 U10 — Yes Details →
v1.42.1-0.20260123225158-b9666dca6178 23 Jan 2026 H2 M4 U10 — Yes Details →
v0.0.0-20260123125613-b55197656546 23 Jan 2026 H2 M4 U10 — Yes Details →
v1.42.1-0.20260123125613-b55197656546 23 Jan 2026 H2 M4 U10 — Yes Details →
v0.0.0-20260122175518-1a013bc77d13 22 Jan 2026 H2 M4 U10 — Yes Details →
v1.42.1-0.20260122175518-1a013bc77d13 22 Jan 2026 H2 M4 U10 — Yes Details →
v1.21.6 20 Jan 2026 H2 M4 U10 — Yes Details →
v0.0.0-20260116163252-93b1a4f63557 16 Jan 2026 H2 M4 U10 — Yes Details →

The newest 120 of 5,822 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 2
  • 2022 7
  • 2024 7
  • 2025 2
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 20 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/containers/buildah

The 5 most severe of 20 vulnerabilities recorded for this package

Search all 20 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2020-10696: Path Traversal in Buildah 8.8 high 1.14.4 18 May 2021
CVE-2024-11218: Buildah Containerfile Vulnerability Leading to Build Breakout 8.6 high 1.38.1 21 Jan 2025
CVE-2022-2989: Buildah's Incorrect Handling of Supplementary Groups 7.1 high 1.27.1 14 Sep 2022
CVE-2022-27651: Non-empty default inheritable capabilities for linux container in Buildah 6.8 medium 1.25.0 01 Apr 2022
CVE-2026-44517: Buildah Package Vulnerability Leading to Build Context Breakout 6.3 medium 1.43.2 22 Jun 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/containers/buildah

Is github.com/containers/buildah safe to use?

Vulert records 20 vulnerabilities for github.com/containers/buildah in Go: 0 critical, 4 high, 5 medium and 0 low, plus 11 not yet rated. 1 of them has no published fix yet, so that is the one to avoid or mitigate.

What is github.com/containers/buildah's Vulert package health score?

Vulert scores github.com/containers/buildah 45/100, which reads as risky. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The registry marks the latest release as deprecated, which caps this score.

Is the latest version of github.com/containers/buildah affected?

Yes. v1.43.5, the version you would install today, has 16 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/containers/buildah should I use?

v1.43.1 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/containers/buildah have?

20 vulnerabilities are recorded for github.com/containers/buildah in the Go ecosystem: 0 critical, 4 high, 5 medium and 0 low, plus 11 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/containers/buildah vulnerabilities disclosed?

2 vulnerabilities were recorded for github.com/containers/buildah in the last 12 months, and the oldest entry in this database dates to 18 May 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/containers/buildah are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/containers/buildah for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/containers/buildah version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.