Critical Security Update for Buildah: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:70640: Important: buildah security update. Affects buildah versions < 2:1.43.3-2.el9_8. Fixed in 2:1.43.3-2.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is a powerful tool designed for building Open Container Initiative (OCI) container images. It allows users to create working containers from scratch or based on existing images, and to build both Docker and OCI images using Dockerfile instructions. This flexibility makes Buildah a crucial component in containerized application development. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this tool.
Vulnerability Detail
The vulnerabilities in Buildah stem from various components of the Go programming language used within the package. These include unencrypted HTTP/2 connections that are susceptible to Denial of Service (CVE-2026-56853), Cross-Site Scripting vulnerabilities via pathological input (CVE-2026-56858), and Denial of Service attacks due to excessive recursion in ASN.1 unmarshalling (CVE-2026-33818). Additionally, there are vulnerabilities related to quadratic complexity in path resolution (CVE-2026-56860) and indefinite KeyUpdate messages in TLS (CVE-2026-56862). These vulnerabilities can lead to service disruptions, data exposure, and potential exploitation by malicious actors.
How To Fix
Minimum fixed version
2:1.43.3-2.el9_8
This is the first release that contains the fix.
sudo dnf update buildahTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict the use of untrusted input in your applications and avoid using unencrypted HTTP/2 connections until the package is updated. Additionally, consider implementing rate limiting on your services to mitigate potential Denial of Service attacks.
Conclusion
The vulnerabilities in Buildah pose significant risks to applications relying on this tool for container image management. It is crucial to update to the latest patched version to mitigate these risks and ensure the security of your applications. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for buildah →
FAQ
Buildah is a tool for building OCI container images, allowing users to create and manage container images efficiently.
The vulnerabilities include Denial of Service attacks, Cross-Site Scripting, and issues related to the Go programming language's handling of HTTP/2 and TLS.
You can update Buildah by running the command 'sudo dnf update buildah buildah-tests' to install the patched version.
Yes, you can limit untrusted input and avoid unencrypted HTTP/2 connections as temporary measures.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for buildah.
