Critical Security Flaw in containernetworking-plugins: Denial of Service Vulnerabilities
Summary
RLSA-2026:70391: Important: containernetworking-plugins security update. Affects containernetworking-plugins versions < 1:1.9.0-4.el9_8. Fixed in 1:1.9.0-4.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The containernetworking-plugins package is part of the Container Network Interface (CNI) project, which provides specifications and libraries for configuring network interfaces in Linux containers. It focuses on ensuring network connectivity for containers and managing resource allocation upon container deletion. This package is crucial for container orchestration and networking in cloud-native environments.
Vulnerability Detail
The vulnerabilities identified in the containernetworking-plugins package include multiple Denial of Service (DoS) issues stemming from various components of the Go programming language. These vulnerabilities can lead to service disruptions, allowing attackers to exploit excessive recursion, quadratic complexity in path resolution, unencrypted HTTP/2 connections, Cross-Site Scripting (XSS) via pathological input, and indefinite KeyUpdate messages. The CVSS score for these vulnerabilities is 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
1:1.9.0-4.el9_8
This is the first release that contains the fix.
sudo dnf update containernetworking-pluginsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing network security measures such as rate limiting and input validation to mitigate potential exploitation of these vulnerabilities. Additionally, avoid using untrusted inputs in your applications.
Conclusion
The containernetworking-plugins package has critical vulnerabilities that can lead to Denial of Service attacks. It is essential to update to the latest patched version to mitigate these risks. Implementing security measures can provide temporary relief until the update is applied.
See every vulnerability recorded for containernetworking-plugins →
FAQ
The vulnerabilities can lead to Denial of Service attacks, causing service disruptions and potential downtime for applications relying on this package.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring any signup.
Implement network security measures such as rate limiting and input validation to reduce the risk of exploitation until you can apply the patch.
The CVSS score for the vulnerabilities in containernetworking-plugins is 8.1, indicating a high severity level.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2026-33818, CVE-2026-56853, CVE-2026-56858, CVE-2026-56860, and CVE-2026-56862.
References
Related vulnerabilities
Recent vulnerabilities recorded for containernetworking-plugins.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
