RHSA-2026:70201

Vulnerability from csaf_opensuse - Published: 2026-09-22 00:00 - Updated: 2026-09-23 17:25
Summary
security update for podman
Severity
Important
Notes
Title of the patch: security update for podman
Description of the patch: This security update provides a functional equivalent of RHSA-2026:70201. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:70201.
Patchnames: RHSA-2026:70201
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-17106
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-19730
4.2 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected products
Recommended 4 products, the same list as for CVE-2026-17106
Threats
Impact moderate
CVE-2026-33810
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-17106
Threats
Impact moderate
CVE-2026-33818
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-17106
Threats
Impact important
CVE-2026-42499
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-17106
Threats
Impact important
CVE-2026-56852
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-17106
Threats
Impact moderate
CVE-2026-56853
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-17106
Threats
Impact important
CVE-2026-56858
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-17106
Threats
Impact moderate
CVE-2026-56859
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-17106
Threats
Impact important
CVE-2026-56860
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 4 products, the same list as for CVE-2026-17106
Threats
Impact moderate
CVE-2026-56862
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-17106
Threats
Impact important
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/r… self
https://www.suse.com/security/cve/CVE-2026-17106/ self
https://www.suse.com/security/cve/CVE-2026-19730/ self
https://www.suse.com/security/cve/CVE-2026-33810/ self
https://www.suse.com/security/cve/CVE-2026-33818/ self
https://www.suse.com/security/cve/CVE-2026-42499/ self
https://www.suse.com/security/cve/CVE-2026-56852/ self
https://www.suse.com/security/cve/CVE-2026-56853/ self
https://www.suse.com/security/cve/CVE-2026-56858/ self
https://www.suse.com/security/cve/CVE-2026-56859/ self
https://www.suse.com/security/cve/CVE-2026-56860/ self
https://www.suse.com/security/cve/CVE-2026-56862/ self
https://www.suse.com/security/cve/CVE-2026-17106 external
https://bugzilla.suse.com/1275243 external
https://www.suse.com/security/cve/CVE-2026-19730 external
https://bugzilla.suse.com/1275283 external
https://www.suse.com/security/cve/CVE-2026-33810 external
https://bugzilla.suse.com/1261662 external
https://www.suse.com/security/cve/CVE-2026-33818 external
https://bugzilla.suse.com/1275034 external
https://www.suse.com/security/cve/CVE-2026-42499 external
https://bugzilla.suse.com/1264502 external
https://www.suse.com/security/cve/CVE-2026-56852 external
https://bugzilla.suse.com/1271661 external
https://bugzilla.suse.com/1280553 external
https://www.suse.com/security/cve/CVE-2026-56853 external
https://bugzilla.suse.com/1275028 external
https://www.suse.com/security/cve/CVE-2026-56858 external
https://bugzilla.suse.com/1275033 external
https://www.suse.com/security/cve/CVE-2026-56859 external
https://bugzilla.suse.com/1275026 external
https://www.suse.com/security/cve/CVE-2026-56860 external
https://bugzilla.suse.com/1275029 external
https://www.suse.com/security/cve/CVE-2026-56862 external
https://bugzilla.suse.com/1275032 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for podman",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:70201.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:70201.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:70201",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_70201.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-17106 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-17106/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-19730 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-19730/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33810 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33810/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33818 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33818/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42499 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42499/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56852 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56852/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56853 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56853/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56858 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56858/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56859 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56859/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56860 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56860/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56862 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56862/"
      }
    ],
    "title": "security update for podman",
    "tracking": {
      "current_release_date": "2026-09-23T17:25:38Z",
      "generator": {
        "date": "2026-09-22T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:70201",
      "initial_release_date": "2026-09-22T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-09-22T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-23T17:25:38Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-docker-7:5.8.2-9.el10_2.noarch",
                "product": {
                  "name": "podman-docker-7:5.8.2-9.el10_2.noarch",
                  "product_id": "podman-docker-7:5.8.2-9.el10_2.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:podman_project:podman:5.8.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/podman-docker@5.8.2-9.el10_2?arch=noarch\u0026epoch=7\u0026upstream=podman-7:5.8.2-9.el10_2.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "podman-7:5.8.2-9.el10_2.x86_64",
                "product": {
                  "name": "podman-7:5.8.2-9.el10_2.x86_64",
                  "product_id": "podman-7:5.8.2-9.el10_2.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:podman_project:podman:5.8.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/podman@5.8.2-9.el10_2?arch=x86_64\u0026epoch=7\u0026upstream=podman-7:5.8.2-9.el10_2.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "podman-remote-7:5.8.2-9.el10_2.x86_64",
                "product": {
                  "name": "podman-remote-7:5.8.2-9.el10_2.x86_64",
                  "product_id": "podman-remote-7:5.8.2-9.el10_2.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:podman_project:podman:5.8.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/podman-remote@5.8.2-9.el10_2?arch=x86_64\u0026epoch=7\u0026upstream=podman-7:5.8.2-9.el10_2.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "podman-tests-7:5.8.2-9.el10_2.x86_64",
                "product": {
                  "name": "podman-tests-7:5.8.2-9.el10_2.x86_64",
                  "product_id": "podman-tests-7:5.8.2-9.el10_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/podman-tests@5.8.2-9.el10_2?arch=x86_64\u0026epoch=7"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 10",
                "product": {
                  "name": "SUSE Liberty Linux 10",
                  "product_id": "SUSE Liberty Linux 10",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:10"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-7:5.8.2-9.el10_2.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64"
        },
        "product_reference": "podman-7:5.8.2-9.el10_2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-docker-7:5.8.2-9.el10_2.noarch as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch"
        },
        "product_reference": "podman-docker-7:5.8.2-9.el10_2.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-remote-7:5.8.2-9.el10_2.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64"
        },
        "product_reference": "podman-remote-7:5.8.2-9.el10_2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "podman-tests-7:5.8.2-9.el10_2.x86_64 as component of SUSE Liberty Linux 10",
          "product_id": "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
        },
        "product_reference": "podman-tests-7:5.8.2-9.el10_2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-17106",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-17106"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
          "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-17106",
          "url": "https://www.suse.com/security/cve/CVE-2026-17106"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275243 for CVE-2026-17106",
          "url": "https://bugzilla.suse.com/1275243"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-17106"
    },
    {
      "cve": "CVE-2026-19730",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-19730"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The \u0027podman quadlet install --replace\u0027 command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated and content from the original is preserved. The command completes with no warning.\n\nThere is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files. However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running podman quadlet install --replace to remove a single line from the end of a Quadlet - including security-sensitive content, like AddCapability - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker.\n\nThe vulnerable code paths are in pkg/domain/infra/abi/quadlet.go (lines 338-360, O_CREATE|O_WRONLY without O_TRUNC) and vendor/go.podman.io/storage/pkg/fileutils/reflink_linux.go (lines 12-19, non-truncating io.Copy fallback).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
          "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-19730",
          "url": "https://www.suse.com/security/cve/CVE-2026-19730"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275283 for CVE-2026-19730",
          "url": "https://bugzilla.suse.com/1275283"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-19730"
    },
    {
      "cve": "CVE-2026-33810",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33810"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
          "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33810",
          "url": "https://www.suse.com/security/cve/CVE-2026-33810"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261662 for CVE-2026-33810",
          "url": "https://bugzilla.suse.com/1261662"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-33810"
    },
    {
      "cve": "CVE-2026-33818",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33818"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
          "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33818",
          "url": "https://www.suse.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275034 for CVE-2026-33818",
          "url": "https://bugzilla.suse.com/1275034"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33818"
    },
    {
      "cve": "CVE-2026-42499",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42499"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
          "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42499",
          "url": "https://www.suse.com/security/cve/CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1264502 for CVE-2026-42499",
          "url": "https://bugzilla.suse.com/1264502"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42499"
    },
    {
      "cve": "CVE-2026-56852",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56852"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
          "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56852",
          "url": "https://www.suse.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271661 for CVE-2026-56852",
          "url": "https://bugzilla.suse.com/1271661"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-56852",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56852"
    },
    {
      "cve": "CVE-2026-56853",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56853"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
          "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56853",
          "url": "https://www.suse.com/security/cve/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275028 for CVE-2026-56853",
          "url": "https://bugzilla.suse.com/1275028"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-56853"
    },
    {
      "cve": "CVE-2026-56858",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56858"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, pathological inputs could close an unescaped \u0027/\u0027 early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
          "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56858",
          "url": "https://www.suse.com/security/cve/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275033 for CVE-2026-56858",
          "url": "https://bugzilla.suse.com/1275033"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56858"
    },
    {
      "cve": "CVE-2026-56859",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56859"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
          "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56859",
          "url": "https://www.suse.com/security/cve/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275026 for CVE-2026-56859",
          "url": "https://bugzilla.suse.com/1275026"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-56859"
    },
    {
      "cve": "CVE-2026-56860",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56860"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, resolving relative paths containing parent directory (\u0027..\u0027) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0027..\u0027 segments, eliminating the quadratic time complexity and significantly reducing memory allocations.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
          "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56860",
          "url": "https://www.suse.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275029 for CVE-2026-56860",
          "url": "https://bugzilla.suse.com/1275029"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56860"
    },
    {
      "cve": "CVE-2026-56862",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56862"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
          "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
          "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56862",
          "url": "https://www.suse.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275032 for CVE-2026-56862",
          "url": "https://bugzilla.suse.com/1275032"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 10:podman-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-docker-7:5.8.2-9.el10_2.noarch",
            "SUSE Liberty Linux 10:podman-remote-7:5.8.2-9.el10_2.x86_64",
            "SUSE Liberty Linux 10:podman-tests-7:5.8.2-9.el10_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-56862"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.