p PatchFirst

SUSE-SU-2026:2733-1

SUSE-SU-2026:2733-1 · Security update for buildah

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

This update for buildah fixes the following issues - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267179). - CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262953). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266648). - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266191). - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266191). - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266191). - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266191). - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266191). - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266191). - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266191). - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266191). - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266191). - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266191). - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266191). - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266191). - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266191).

Fix available

Published
Updated

Stack: system

Affected products and versions

  • buildah SUSE:Linux Enterprise Module for Containers 15 SP7

    Affected ranges
    • ECOSYSTEM: < 1.35.5-150500.3.62.1

    Update to 1.35.5-150500.3.62.1

  • buildah SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS

    Affected ranges
    • ECOSYSTEM: < 1.35.5-150500.3.62.1

    Update to 1.35.5-150500.3.62.1

  • buildah SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS

    Affected ranges
    • ECOSYSTEM: < 1.35.5-150500.3.62.1

    Update to 1.35.5-150500.3.62.1

  • buildah SUSE:Linux Enterprise Server 15 SP5-LTSS

    Affected ranges
    • ECOSYSTEM: < 1.35.5-150500.3.62.1

    Update to 1.35.5-150500.3.62.1

  • buildah SUSE:Linux Enterprise Server 15 SP6-LTSS

    Affected ranges
    • ECOSYSTEM: < 1.35.5-150500.3.62.1

    Update to 1.35.5-150500.3.62.1

  • buildah SUSE:Linux Enterprise Server for SAP Applications 15 SP5

    Affected ranges
    • ECOSYSTEM: < 1.35.5-150500.3.62.1

    Update to 1.35.5-150500.3.62.1

  • buildah SUSE:Linux Enterprise Server for SAP Applications 15 SP6

    Affected ranges
    • ECOSYSTEM: < 1.35.5-150500.3.62.1

    Update to 1.35.5-150500.3.62.1

Original sources

Check your server →