Critical Security Update for runc: Mitigating Denial of Service Vulnerability
Summary
ALSA-2026:70191: Important: runc security update. Affects runc versions < 4:1.4.2-3.el9_8. Fixed in 4:1.4.2-3.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
runc is a lightweight, portable implementation of the Open Container Format (OCF) that serves as a container runtime. It is widely used in various container orchestration platforms to manage the lifecycle of containers. The tool is designed to be efficient and secure, but vulnerabilities can arise, impacting its reliability and the security of the containers it manages.
Vulnerability Detail
The vulnerability identified as CVE-2026-56860 pertains to a Denial of Service (DoS) issue caused by quadratic complexity in path resolution within the net/url package of golang. This vulnerability can be exploited to cause excessive resource consumption, potentially leading to service outages and degraded performance of applications relying on runc for container management.
How To Fix
Minimum fixed version
4:1.4.2-3.el9_8
This is the first release that contains the fix.
sudo dnf update runcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the security update as soon as it is available.
Conclusion
In summary, the runc package has a critical vulnerability (CVE-2026-56860) that can lead to Denial of Service due to inefficient path resolution. It is imperative to update to the patched version (4:1.4.2-3.el9_8) to safeguard your applications. Regular monitoring and updates are essential for maintaining security.
See every vulnerability recorded for runc →
FAQ
CVE-2026-56860 is a vulnerability in the net/url package of golang that can lead to Denial of Service due to quadratic complexity in path resolution.
This vulnerability can cause excessive resource consumption, potentially leading to service outages and degraded performance of applications running in containers managed by runc.
While no specific workarounds are available, it is crucial to prioritize updating runc to mitigate the risk associated with this vulnerability.
For more details, you can refer to the CVE page associated with CVE-2026-56860, which provides in-depth information about the vulnerability and its impact.
Vulert allows you to monitor and alert in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for runc.
