Critical Security Update for Skopeo: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:28074: Important: skopeo security update. Affects skopeo versions < 2:1.22.2-6.el9_8. Fixed in 2:1.22.2-6.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Skopeo is a command-line utility that facilitates the inspection of container images from various registries, retrieval of images and their layers, and the creation and verification of signatures. It is widely used in containerized environments to manage image lifecycles efficiently. However, recent vulnerabilities have been identified that could lead to denial of service attacks, impacting the reliability and security of applications relying on this tool.
Vulnerability Detail
The vulnerabilities stem from issues within the Go programming language's crypto/x509 and crypto/tls packages. Specifically, there are three denial of service vulnerabilities: one related to inefficient certificate chain validation (CVE-2026-32281), another concerning multiple TLS 1.3 key update messages (CVE-2026-32283), and a third involving certificate chain building (CVE-2026-32280). These vulnerabilities could allow attackers to exploit the skopeo command, potentially leading to service disruptions and degraded performance.
How To Fix
Minimum fixed version
2:1.22.2-6.el9_8
This is the first release that contains the fix.
sudo dnf update skopeoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider limiting access to the skopeo command and monitoring its usage closely to mitigate potential exploitation until the update can be applied.
Conclusion
In summary, the recent vulnerabilities identified in Skopeo pose significant risks related to denial of service attacks. It is crucial for users to update their installations to the latest patched versions to ensure the security and reliability of their container management processes.
See every vulnerability recorded for skopeo →
FAQ
Skopeo is a command-line tool that allows users to interact with container images and image registries, enabling inspection, retrieval, and signature verification.
The identified vulnerabilities could lead to denial of service attacks, causing disruptions in services that rely on Skopeo for managing container images.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the packages right away, limit access to the skopeo command and monitor its usage to reduce the risk of exploitation.
For more details, refer to the CVE pages listed in the advisory, which provide in-depth information about each vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for skopeo.
