{"id":"CLSA-2026-1790584206","summary":"podman: Fix of 7 CVEs","details":"- CVE-2026-39830: drop unsolicited global and channel request responses in the\n  vendored golang.org/x/crypto/ssh mux and channel read paths, so a peer can no\n  longer fill the bounded globalResponses / ch.msg buffers and stall the\n  connection's read loop\n- Rebuild against golang \u003e= 1.25.7-1.el9_6.tuxcare.els16 to pick up the Go\n  standard library fixes for:\n- CVE-2026-33818: enforce a recursion limit in encoding/asn1 Unmarshal to\n  prevent stack exhaustion on deeply nested input\n- CVE-2026-56853: apply ReadHeaderTimeout while sniffing the unencrypted\n  HTTP/2 client preface in net/http\n- CVE-2026-56858: do not close an unescaped '/' early in html/template,\n  preventing attacker-controlled content injection\n- CVE-2026-56859: keep the recursion depth counter across DecodeElement in\n  encoding/xml to prevent stack exhaustion\n- CVE-2026-56860: resolve '..' path segments in net/url with index-based\n  backtracking to remove the quadratic time complexity\n- CVE-2026-56862: only treat post-handshake KeyUpdate messages as\n  state-advancing in crypto/tls, so a client cannot force unbounded key\n  derivation","modified":"2026-10-26T09:43:51.533767201Z","published":"2026-09-28T08:30:21Z","upstream":["CVE-2026-33818","CVE-2026-39830","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1790584206.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39830"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862"}],"affected":[{"package":{"name":"podman","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/podman?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-13.el9_6.tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790584206.json"}},{"package":{"name":"podman-docker","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/podman-docker?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-13.el9_6.tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790584206.json"}},{"package":{"name":"podman-plugins","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/podman-plugins?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-13.el9_6.tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790584206.json"}},{"package":{"name":"podman-remote","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/podman-remote?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-13.el9_6.tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790584206.json"}},{"package":{"name":"podman-tests","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/podman-tests?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:5.4.0-13.el9_6.tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1790584206.json"}}],"schema_version":"1.9.0"}