Critical Security Vulnerability in Buildah: Important Update Required
Summary
RLSA-2026:70640: Important: buildah security update. Affects buildah versions < 2:1.43.3-2.el9_8. Fixed in 2:1.43.3-2.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is a powerful tool designed for building Open Container Initiative (OCI) container images. It allows users to create working containers from scratch or based on existing images, and to build both Docker and OCI images using Dockerfile instructions. The tool is widely used in containerized environments, making its security paramount. Recent vulnerabilities have been identified that could potentially compromise the integrity and availability of applications relying on Buildah.
Vulnerability Detail
The vulnerabilities in Buildah stem from various components of the Go programming language, which the tool utilizes. Key issues include unencrypted HTTP/2 connections that are susceptible to Denial of Service (CVE-2026-56853), Cross-Site Scripting vulnerabilities via pathological input (CVE-2026-56858), and Denial of Service attacks due to excessive recursion in ASN.1 unmarshalling (CVE-2026-33818). Additionally, there are vulnerabilities related to quadratic complexity in path resolution (CVE-2026-56860) and indefinite KeyUpdate messages in TLS (CVE-2026-56862). These vulnerabilities could lead to service disruptions and data exposure, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
2:1.43.3-2.el9_8
This is the first release that contains the fix.
sudo dnf update buildahTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of untrusted input in HTML templates and avoid using unencrypted HTTP/2 connections until the package is updated. Additionally, monitoring network traffic for unusual patterns may help mitigate some risks.
Conclusion
In summary, the vulnerabilities identified in Buildah pose significant risks to users and their applications. It is crucial to update to the latest patched version to mitigate these risks effectively. Users are encouraged to monitor their systems and utilize tools like Vulert for ongoing vulnerability management.
See every vulnerability recorded for buildah →
FAQ
Buildah is a tool for building OCI container images, allowing users to create and manage container images efficiently.
The vulnerabilities can lead to Denial of Service attacks, Cross-Site Scripting, and potential data exposure, affecting the availability and security of applications.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, consider implementing workarounds such as limiting untrusted input and monitoring network traffic for anomalies.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for buildah.
