Critical Security Update for oci-seccomp-bpf-hook: Denial of Service Vulnerability
Summary
ALSA-2026:36617: Important: oci-seccomp-bpf-hook security update. Affects oci-seccomp-bpf-hook versions < 1.2.11-2.el9_8. Fixed in 1.2.11-2.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The oci-seccomp-bpf-hook is a library designed for applications utilizing the Container Pod concept, which is widely adopted in Kubernetes environments. This package generates seccomp JSON files based on EBF syscalls, providing enhanced security for containerized applications. However, it has been found to contain a vulnerability that could lead to a Denial of Service (DoS) attack, compromising the stability of applications relying on this library.
Vulnerability Detail
The vulnerability is rooted in the Go net package, specifically in the LookupCNAME function, which can be exploited through a long CNAME response. This could allow an attacker to overwhelm the system, leading to a Denial of Service condition. The vulnerability is identified as CVE-2026-33811, and it poses significant risks to applications that depend on the oci-seccomp-bpf-hook for secure operation.
How To Fix
Minimum fixed version
1.2.11-2.el9_8
This is the first release that contains the fix.
sudo dnf update oci-seccomp-bpf-hookTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. It is strongly recommended to apply the security update as soon as possible to mitigate the risks.
Conclusion
The oci-seccomp-bpf-hook package has a critical vulnerability that could lead to Denial of Service attacks. It is crucial to update to the patched version to ensure the security and stability of applications using this library. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for oci-seccomp-bpf-hook →
FAQ
The oci-seccomp-bpf-hook is a library that helps generate seccomp JSON files for containerized applications, enhancing their security by controlling system calls.
CVE-2026-33811 refers to a specific vulnerability in the Go net package that can lead to a Denial of Service attack through long CNAME responses.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The primary impact is a Denial of Service condition, which can disrupt the availability and performance of applications relying on the oci-seccomp-bpf-hook.
Yes, a patch is available in version 1.2.11-2.el9_8 of the oci-seccomp-bpf-hook package. It is recommended to update to this version to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for oci-seccomp-bpf-hook.
