Critical Security Vulnerability in Skopeo: Important Update Required
Summary
ALSA-2026:70641: Important: skopeo security update. Affects skopeo versions < 2:1.22.2-8.el9_8. Fixed in 2:1.22.2-8.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Skopeo is a command line utility that allows users to inspect images and repositories directly on Docker registries without the need to pull them. It is widely used for managing container images and ensuring the integrity of containerized applications. However, recent vulnerabilities have been identified that could potentially compromise the security of systems utilizing Skopeo.
Vulnerability Detail
The vulnerabilities in Skopeo stem from various components of the Go programming language, including Cross-Site Scripting (CVE-2026-56858), Denial of Service (CVE-2026-33818, CVE-2026-56860, CVE-2026-56853, CVE-2026-56862). These vulnerabilities can lead to severe impacts such as service outages and exploitation of the application through malicious inputs. The vulnerabilities arise from pathological input handling, excessive recursion in unmarshalling, quadratic complexity in path resolution, unencrypted HTTP/2 connections, and indefinite KeyUpdate messages in TLS.
How To Fix
Minimum fixed version
2:1.22.2-8.el9_8
This is the first release that contains the fix.
sudo dnf update skopeoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of Skopeo in environments where untrusted input is processed, or avoid using features that may expose the application to the identified vulnerabilities until the update is applied.
Conclusion
The identified vulnerabilities in Skopeo pose significant risks to users and their systems. It is crucial to apply the necessary updates to mitigate these risks and ensure the security of containerized applications. Regular monitoring and prompt action are essential in maintaining a secure environment.
See every vulnerability recorded for skopeo →
FAQ
Skopeo is a command line tool for managing container images and repositories, allowing users to inspect images directly on Docker registries.
The main vulnerabilities include Cross-Site Scripting and multiple Denial of Service issues that can affect the application's performance and security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider implementing workarounds such as limiting the use of Skopeo in untrusted environments.
For detailed information, refer to the CVE pages linked in the advisory or check the security update documentation provided by the AlmaLinux project.
Related vulnerabilities
Recent vulnerabilities recorded for skopeo.
