Vulnerability feed

Executive summary

Red Hat's advisory RHSA-2026:89760 updates the container-tools:rhel8 module on Red Hat Enterprise Linux 8, which provides tools such as podman, buildah, skopeo, and runc. Red Hat rates it Important and describes two Go standard library flaws, one causing denial of service through crafted HTTP Range headers and one enabling man-in-the-middle attacks through untrusted intermediate certificates. Red Hat recommends applying the updated packages described in the advisory.

Technical summary

The advisory lists two security fixes: CVE-2026-78667, a denial of service in net/http via crafted HTTP Range headers, and CVE-2026-111943, a man-in-the-middle issue in crypto/x509 involving untrusted intermediate certificates, both attributed to golang. The advisory does not state CVSS scores, attack preconditions, or exploitation status beyond the Important rating. Updated package versions are listed for the container-tools components, such as podman-4.9.4-38, buildah-1.33.15-2, runc-1.2.9-9, and skopeo-1.14.6-5, and the advisory's references point to a Red Hat solution article for application steps. Workarounds and detection guidance are not stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Dropped extracted product not named in the source: Go golang

Summarized from access.redhat.com/errata/RHSA-2026:89760

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affects

Red HatRed Hat Enterprise LinuxRed Hat container-tools