Critical Security Update for runc: Addressing Denial of Service and Memory Exhaustion Vulnerabilities
Summary
ALSA-2026:3291: Important: runc security update. Affects runc versions < 4:1.4.0-2.el9_7. Fixed in 4:1.4.0-2.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
runc is a lightweight and portable implementation of the Open Container Format (OCF), serving as a container runtime that allows users to create and manage containers. It is widely used in various container orchestration platforms and is essential for running applications in isolated environments. The recent vulnerabilities identified in runc highlight its susceptibility to certain crafted inputs that can lead to severe resource consumption issues, impacting the stability and availability of containerized applications.
Vulnerability Detail
The vulnerabilities in runc stem from issues in the underlying Go libraries it utilizes. Specifically, CVE-2025-61729 allows for Denial of Service (DoS) attacks through excessive resource consumption when processing crafted certificates. CVE-2025-61726 introduces memory exhaustion during query parameter parsing in the net/url package, which can lead to application crashes. Additionally, CVE-2025-68121 relates to unexpected session resumption in the crypto/tls package, potentially allowing unauthorized access to secure sessions. These vulnerabilities can severely impact the performance and security of applications relying on runc.
How To Fix
Minimum fixed version
4:1.4.0-2.el9_7
This is the first release that contains the fix.
sudo dnf update runcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the resources allocated to containers running with runc to mitigate the impact of potential DoS attacks. This can be done by configuring resource limits in the container orchestration settings, such as CPU and memory limits, to prevent excessive consumption.
Conclusion
The vulnerabilities identified in runc pose significant risks to containerized applications, including potential Denial of Service and memory exhaustion. It is crucial for users to update to the latest patched version to safeguard their systems. Additionally, implementing resource limits can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for runc →
FAQ
runc is a lightweight container runtime that implements the Open Container Format, allowing users to create and manage containers.
The main vulnerabilities include Denial of Service due to excessive resource consumption, memory exhaustion in query parameter parsing, and unexpected session resumption in TLS.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without requiring any signup.
If immediate updates are not possible, consider implementing resource limits on your containers to mitigate the risk of resource exhaustion.
For more details, refer to the CVE pages listed in the vulnerability report, which provide in-depth information about each issue.
Related vulnerabilities
Recent vulnerabilities recorded for runc.
