Critical Vulnerability in oci-seccomp-bpf-hook: Denial of Service Risk
Summary
RLSA-2026:36617: Important: oci-seccomp-bpf-hook security update. Affects oci-seccomp-bpf-hook versions < 0:1.2.11-2.el9_8. Fixed in 0:1.2.11-2.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The oci-seccomp-bpf-hook is a library designed for applications utilizing the Container Pod concept, which is widely adopted in Kubernetes environments. It generates seccomp JSON files based on EBF syscalls, enhancing security for containerized applications. However, it is susceptible to vulnerabilities that can lead to severe security risks, including Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability identified as CVE-2026-33811 affects the Go net package used within the oci-seccomp-bpf-hook. It allows an attacker to exploit the LookupCNAME function, potentially leading to a Denial of Service condition through excessively long CNAME responses. This can disrupt service availability and impact the overall functionality of applications relying on this library.
How To Fix
Minimum fixed version
0:1.2.11-2.el9_8
This is the first release that contains the fix.
sudo dnf update oci-seccomp-bpf-hookTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the use of the LookupCNAME function or implement rate limiting on DNS queries to mitigate the risk of a Denial of Service attack until the package is updated.
Conclusion
The oci-seccomp-bpf-hook package has a critical vulnerability that can lead to Denial of Service attacks. It is essential to update to the latest patched version to mitigate risks. Users should also consider temporary workarounds while preparing for updates.
See every vulnerability recorded for oci-seccomp-bpf-hook →
FAQ
CVE-2026-33811 is a vulnerability in the Go net package that can lead to Denial of Service through long CNAME responses.
If your application uses the oci-seccomp-bpf-hook, it may be susceptible to service disruptions caused by this vulnerability.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing workarounds such as limiting the use of the vulnerable function or applying rate limiting on DNS queries.
Related vulnerabilities
Recent vulnerabilities recorded for oci-seccomp-bpf-hook.
