Critical Security Update for Skopeo: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:3340: Important: skopeo security update. Affects skopeo versions < 2:1.20.0-3.el9_7. Fixed in 2:1.20.0-3.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Skopeo is a command-line utility that facilitates the inspection of container images from various registries, allowing users to retrieve images and image layers, as well as manage signatures for file creation and verification. Its functionality is crucial for developers working with containerized applications, ensuring they can efficiently manage and secure their images. However, recent vulnerabilities have been identified that could compromise the security and stability of systems utilizing Skopeo.
Vulnerability Detail
The vulnerabilities affecting Skopeo stem from issues in the underlying Go libraries it utilizes. Specifically, there are three critical vulnerabilities: CVE-2025-61729, which allows for a Denial of Service (DoS) due to excessive resource consumption from crafted certificates; CVE-2025-61726, which can lead to memory exhaustion during query parameter parsing; and CVE-2025-68121, which involves unexpected session resumption in TLS connections. These vulnerabilities can lead to service disruptions, potential data leaks, and overall system instability if exploited.
How To Fix
Minimum fixed version
2:1.20.0-3.el9_7
This is the first release that contains the fix.
sudo dnf update skopeoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if you are unable to update Skopeo immediately, you can limit access to the affected services and monitor for unusual activity. Additionally, consider using alternative methods for image management until the update can be applied.
Conclusion
In summary, the recent vulnerabilities identified in Skopeo pose significant risks to users and their systems. It is crucial to update to the latest patched version to ensure security and stability. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, providing an additional layer of protection.
See every vulnerability recorded for skopeo →
FAQ
Skopeo is a command-line tool that allows users to manage container images, including inspecting, copying, and signing images from various registries.
The main vulnerabilities include a Denial of Service due to excessive resource consumption, memory exhaustion during URL parsing, and unexpected session resumption in TLS.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file, such as package-lock.json, to check for any vulnerabilities.
If an immediate update is not possible, limit access to the affected services and monitor for any unusual activity as a temporary workaround.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2025-61726, CVE-2025-61729, and CVE-2025-68121.
Related vulnerabilities
Recent vulnerabilities recorded for skopeo.
