Critical Security Update for Buildah: Denial of Service Vulnerability
Summary
ALSA-2026:19186: Important: buildah security update. Affects buildah versions < 2:1.43.1-1.el9_8. Fixed in 2:1.43.1-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is a powerful tool designed for building Open Container Initiative (OCI) container images. It allows users to create working containers from scratch or existing images, and to build images using Dockerfile instructions. This flexibility makes Buildah a vital component for developers working with containerized applications. However, the recent discovery of a vulnerability in the Go JOSE library, which Buildah relies on, poses a significant risk to users.
Vulnerability Detail
The vulnerability identified as CVE-2026-34986 affects the Go JOSE library used in Buildah. It allows for a Denial of Service (DoS) attack via a crafted JSON Web Encryption (JWE) object. An attacker could exploit this vulnerability to disrupt the normal operation of applications relying on Buildah, potentially leading to service outages and degraded performance. This vulnerability is particularly concerning for environments that depend heavily on container orchestration and deployment.
How To Fix
Minimum fixed version
2:1.43.1-1.el9_8
This is the first release that contains the fix.
sudo dnf update buildahTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the security update as soon as it is available.
Conclusion
The discovery of CVE-2026-34986 highlights a critical vulnerability in the Buildah package, specifically related to its dependency on the Go JOSE library. Users are strongly advised to update to the latest patched version to safeguard their applications against potential Denial of Service attacks. Regular monitoring and updates are essential to maintain security in containerized environments.
See every vulnerability recorded for buildah →
FAQ
CVE-2026-34986 is a vulnerability in the Go JOSE library that can lead to a Denial of Service (DoS) when processing crafted JSON Web Encryption (JWE) objects.
This vulnerability can disrupt the operation of Buildah, potentially causing service outages for applications that depend on it for container image building.
You should update your Buildah package to version 2:1.43.1-1.el9_8 or later to mitigate the risk associated with this vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Vulert is a tool that monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for buildah.
