Critical Security Update for Buildah: Addressing Denial of Service and Security Bypass Vulnerabilities
Summary
ALSA-2026:37410: Important: buildah security update. Affects buildah versions < 2:1.43.1-3.el9_8. Fixed in 2:1.43.1-3.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is a powerful tool designed for building Open Container Initiative (OCI) container images. It allows users to create working containers from scratch or existing images, and to build images using Dockerfile instructions. Buildah is integral to container management, providing flexibility and efficiency in image creation. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing this package.
Vulnerability Detail
The vulnerabilities stem from issues in the golang.org/x/crypto/ssh and golang.org/x/crypto/ssh/agent packages. Specifically, CVE-2026-39835 allows for a Denial of Service attack via crafted SSH certificates, potentially disrupting services. Meanwhile, CVE-2026-39832 presents a security bypass risk due to improper handling of key restrictions, which could allow unauthorized access to sensitive operations. Both vulnerabilities pose significant risks to the integrity and availability of systems using Buildah.
How To Fix
Minimum fixed version
2:1.43.1-3.el9_8
This is the first release that contains the fix.
sudo dnf update buildahTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for these vulnerabilities. The best course of action is to apply the security updates as soon as they are available.
Conclusion
The identified vulnerabilities in Buildah present significant security risks that must be addressed promptly. By updating to the latest versions of the affected packages, users can protect their systems from potential attacks and ensure the integrity of their container management processes.
See every vulnerability recorded for buildah →
FAQ
The main vulnerabilities are CVE-2026-39835, which allows for Denial of Service attacks, and CVE-2026-39832, which enables security bypass due to improper key restriction handling.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected without requiring any installation.
It is recommended to update your Buildah and Buildah-tests packages to the latest patched version (2:1.43.1-3.el9_8 or later) to ensure your system is secure.
While specific exploits have not been publicly disclosed, the nature of the vulnerabilities suggests that they could be leveraged for Denial of Service attacks or unauthorized access.
For more detailed information, you can refer to the CVE pages associated with the vulnerabilities: CVE-2026-39832 and CVE-2026-39835.
Related vulnerabilities
Recent vulnerabilities recorded for buildah.
