Vulnerability feed

Executive summary

Red Hat has released a security update for skopeo, a tool for inspecting and moving container images, on Red Hat Enterprise Linux 10. Red Hat rates the update as Important and lists three vulnerabilities, including an arbitrary file write in podman, a denial of service in Go's net/http, and a man-in-the-middle issue in Go's crypto/x509. Red Hat recommends applying the updated skopeo packages listed in the advisory.

Technical summary

The advisory describes three CVEs: CVE-2025-11395, an arbitrary file write when importing an OCI archive in podman; CVE-2026-78667, a denial of service via crafted HTTP Range headers in the Go net/http package; and CVE-2026-111943, a man-in-the-middle issue in Go crypto/x509 involving untrusted intermediate certificates. The advisory does not state attack vectors or preconditions in detail, and it refers readers to the CVE pages for CVSS scores and impact. The fixed package is skopeo-1.22.2-6.el10_2 across the listed RHEL 10 and 10.2 variants. Workarounds, exploitation status, and detection guidance are not stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Dropped extracted product not named in the source: containers podman

Dropped extracted product not named in the source: Go net/http

Dropped extracted product not named in the source: Go crypto/x509

Summarized from access.redhat.com/errata/RHSA-2026:89761

Score

No CVSS score published.

Affects

Red HatRed Hat Enterprise LinuxRed Hat skopeo