{"id":"CLSA-2026-1790850483","summary":"buildah: Fix of 7 CVEs","details":"- Rebuild el9_6 against golang \u003e= 1.25.7-1.el9_6.tuxcare.els16 to pick up the Go\n  standard library fixes for:\n- CVE-2026-33818: enforce a recursion limit in encoding/asn1 Unmarshal to\n  prevent stack exhaustion on deeply nested input\n- CVE-2026-56853: apply ReadHeaderTimeout while sniffing the unencrypted\n  HTTP/2 client preface in net/http\n- CVE-2026-56858: do not close an unescaped '/' early in html/template,\n  preventing attacker-controlled content injection\n- CVE-2026-56860: avoid quadratic complexity in net/url resolvePath by\n  resolving '..' segments with index-based backtracking on a byte buffer\n- CVE-2026-56862: stop counting handshake messages as state-advancing once the\n  crypto/tls handshake has completed, bounding the key derivation work a client\n  can force with repeated post-handshake KeyUpdate messages","modified":"2026-10-26T09:30:52.611977527Z","published":"2026-10-21T23:01:45Z","upstream":["CVE-2026-33818","CVE-2026-56853","CVE-2026-56858","CVE-2026-56860","CVE-2026-56862"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1790850483.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862"}],"affected":[{"package":{"name":"buildah","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/buildah?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.6-1.el9_2.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1790850483.json"}},{"package":{"name":"buildah-tests","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/buildah-tests?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.39.6-1.el9_2.tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1790850483.json"}}],"schema_version":"1.9.0"}