Critical Security Update for Skopeo: Addressing IPv6 Parsing and DNS SAN Denial of Service Vulnerabilities
Summary
ALSA-2026:36317: Important: skopeo security update. Affects skopeo versions < 2:1.22.2-7.el9_8. Fixed in 2:1.22.2-7.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Skopeo is a command-line utility that facilitates the inspection of container images from various registries, retrieval of images and their layers, and the use of signatures for file creation and verification. It is widely used in containerized environments to manage images efficiently. However, vulnerabilities in its underlying libraries can expose users to security risks, necessitating timely updates.
Vulnerability Detail
The vulnerabilities identified in Skopeo stem from issues in the net/url and crypto/x509 packages. The first vulnerability, CVE-2026-25679, involves incorrect parsing of IPv6 host literals, which could lead to unexpected behavior or security breaches. The second vulnerability, CVE-2026-27145, is a Denial of Service (DoS) risk caused by excessive processing of DNS Subject Alternative Name (SAN) entries, potentially overwhelming the system and rendering it unresponsive. Both vulnerabilities can compromise the integrity and availability of applications relying on Skopeo.
How To Fix
Minimum fixed version
2:1.22.2-7.el9_8
This is the first release that contains the fix.
sudo dnf update skopeoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using features that rely on IPv6 parsing or DNS SAN processing until the update is applied. However, this is not a long-term solution and updating the package is strongly recommended.
Conclusion
The identified vulnerabilities in Skopeo pose significant risks to users, particularly in terms of security and system availability. It is crucial to update to the latest patched version to mitigate these risks effectively. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring that your applications remain secure.
See every vulnerability recorded for skopeo →
FAQ
Skopeo is a command-line tool that allows users to manage container images, including inspecting, copying, and signing images from container registries.
The vulnerabilities include incorrect parsing of IPv6 host literals (CVE-2026-25679) and a Denial of Service risk due to excessive DNS SAN processing (CVE-2026-27145).
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, consider limiting the use of features that involve IPv6 or DNS SAN processing until the vulnerabilities are addressed.
For detailed information about the vulnerabilities, including CVSS scores and acknowledgments, refer to the CVE pages linked in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for skopeo.
