Critical Security Update for Skopeo: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:29035: Important: skopeo security update. Affects skopeo versions < 2:1.22.2-2.el10_2. Fixed in 2:1.22.2-2.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Skopeo is a command-line utility that facilitates the inspection of container images from various registries, retrieval of images and their layers, and the creation and verification of signatures. It is widely used in containerized environments to manage and interact with container images efficiently. However, recent vulnerabilities have been identified that could potentially compromise the security of applications relying on Skopeo.
Vulnerability Detail
The vulnerabilities stem from several components within the Go programming language libraries utilized by Skopeo. These include incorrect parsing of IPv6 host literals (CVE-2026-25679), denial of service (DoS) vulnerabilities due to inefficient certificate chain validation (CVE-2026-32281), and issues with multiple TLS 1.3 key update messages (CVE-2026-32283). These vulnerabilities could allow attackers to exploit the affected components, leading to service disruptions or unauthorized access.
How To Fix
Minimum fixed version
2:1.22.2-2.el10_2
This is the first release that contains the fix.
sudo dnf update skopeoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of Skopeo by restricting access to the command-line utility and avoiding the use of vulnerable features until the update is applied. No specific code workaround is available.
Conclusion
The identified vulnerabilities in Skopeo pose significant risks that could affect the security and stability of applications utilizing this tool. It is crucial for users to update to the latest patched version to mitigate these risks effectively.
See every vulnerability recorded for skopeo →
FAQ
Skopeo is a command-line tool that allows users to interact with container images and registries, enabling image inspection, retrieval, and signature verification.
The vulnerabilities include issues with IPv6 parsing, denial of service in certificate chain validation, and problems with TLS 1.3 key updates, which could lead to service disruptions.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Check your application against the vulnerabilities using the Vulert playground at Vulert Scanner.
If an immediate update is not possible, limit access to Skopeo and avoid using features that may expose your system to the vulnerabilities until the update can be applied.
For detailed information about the vulnerabilities, including CVSS scores and acknowledgments, refer to the CVE pages listed in the related section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for skopeo.
