Critical Security Update for Buildah: Addressing IPv6 Host Literal Parsing Flaw
Summary
ALSA-2026:19032: Important: buildah security update. Affects buildah versions < 2:1.43.1-1.el10_2. Fixed in 2:1.43.1-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is a powerful tool designed for building Open Container Initiative (OCI) container images. It allows users to create working containers from scratch or existing images, and to build both Docker and OCI images using Dockerfile instructions. This flexibility makes Buildah a vital component in containerized application development. However, a recent security vulnerability has been identified that affects the parsing of IPv6 host literals, potentially exposing users to security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2026-25679, stems from an incorrect parsing mechanism in the net/url package of Buildah. This flaw can lead to improper handling of IPv6 host literals, which may allow attackers to exploit the system by crafting malicious URLs. The ramifications of this vulnerability could include unauthorized access to sensitive data or execution of arbitrary code, posing significant risks to the integrity and security of containerized applications.
How To Fix
Minimum fixed version
2:1.43.1-1.el10_2
This is the first release that contains the fix.
sudo dnf update buildahTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using IPv6 host literals in their configurations until the package is updated. This may involve modifying application settings or network configurations to rely solely on IPv4 addresses.
Conclusion
The Buildah package has a critical vulnerability that affects the parsing of IPv6 host literals, which could lead to significant security risks. Users are strongly encouraged to update to the patched version to ensure their applications remain secure. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for buildah →
FAQ
CVE-2026-25679 is a security vulnerability in the Buildah package that involves incorrect parsing of IPv6 host literals, potentially leading to security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive data or execution of arbitrary code, compromising the security of containerized applications.
You can update the Buildah package by running the command 'sudo dnf update buildah' in your terminal.
Yes, as a temporary measure, avoid using IPv6 host literals in your configurations until the package is updated.
Related vulnerabilities
Recent vulnerabilities recorded for buildah.
