Critical Security Flaw in runc: Denial of Service Vulnerability
Summary
RLSA-2026:70191: Important: runc security update. Affects runc versions < 4:1.4.2-3.el9_8. Fixed in 4:1.4.2-3.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
runc is a lightweight and portable implementation of the Open Container Format (OCF) that serves as a container runtime. It is widely used in container orchestration systems to manage the lifecycle of containers. The tool is essential for running containers in a secure and efficient manner, but it is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as CVE-2026-56860 affects the net/url package in Golang, which is utilized by runc. This flaw introduces a Denial of Service (DoS) risk due to quadratic complexity in path resolution. An attacker could exploit this vulnerability by crafting specific inputs that cause excessive resource consumption, potentially leading to service outages or degraded performance. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
4:1.4.2-3.el9_8
This is the first release that contains the fix.
sudo dnf update runcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the input size or sanitize inputs to mitigate the risk of triggering the vulnerability until the package is updated. However, the most effective solution is to apply the patch as soon as possible.
Conclusion
The runc package has a critical vulnerability that can lead to Denial of Service attacks. It is crucial to update to the patched version to mitigate risks. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert for real-time alerts.
See every vulnerability recorded for runc →
FAQ
CVE-2026-56860 is a vulnerability in the net/url package of Golang used by runc, which can lead to Denial of Service due to quadratic complexity in path resolution.
If exploited, this vulnerability can cause excessive resource consumption, leading to service outages or degraded performance of containerized applications.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
If immediate updates are not possible, consider implementing input size limitations or sanitizing inputs to reduce the risk of exploitation until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for runc.
