Critical Security Update for runc: Addressing Multiple Denial of Service Vulnerabilities
Summary
ALSA-2026:29702: Important: runc security update. Affects runc versions < 4:1.4.2-2.el9_8. Fixed in 4:1.4.2-2.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
runc is a lightweight, portable implementation of the Open Container Format (OCF) that serves as a container runtime. It is widely used in container orchestration systems to manage the lifecycle of containers. As a core component of container technology, runc is crucial for ensuring the security and efficiency of containerized applications. However, vulnerabilities in runc can lead to severe security risks, including Denial of Service (DoS) attacks, which can disrupt service availability and compromise system integrity.
Vulnerability Detail
The vulnerabilities identified in runc stem from incorrect parsing of IPv6 host literals and inefficient certificate chain validation in the Go programming language's crypto/x509 package. Specifically, CVE-2026-25679 allows for incorrect handling of IPv6 addresses, while CVE-2026-32280 and CVE-2026-32281 expose the system to Denial of Service attacks through inefficient processing of certificate chains. These vulnerabilities can lead to significant service disruptions and potential exploitation by malicious actors.
How To Fix
Minimum fixed version
4:1.4.2-2.el9_8
This is the first release that contains the fix.
sudo dnf update runcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for these vulnerabilities. The best course of action is to apply the security update as soon as it is available.
Conclusion
In summary, the runc security update addresses critical vulnerabilities that could lead to Denial of Service attacks and incorrect handling of IPv6 addresses. It is imperative to update to the latest version to ensure the security and stability of your containerized applications.
See every vulnerability recorded for runc →
FAQ
runc is a lightweight container runtime that implements the Open Container Format, allowing for the management and execution of containers.
The main vulnerabilities include incorrect IPv6 parsing and Denial of Service issues related to certificate chain validation in Go's crypto/x509 package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version as soon as possible to avoid potential exploitation.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2026-25679, CVE-2026-32280, and CVE-2026-32281.
Related vulnerabilities
Recent vulnerabilities recorded for runc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
