Security update for buildah
This update for buildah fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266648). - CVE-2026-39829: golang.org/x/crypto/ssh: pathological RSA/DSA parameters may cause DoS (bsc#1266191). - CVE-2026-39830: golang.org/x/crypto/ssh: client can cause server deadlock on unexpected responses (bsc#1266191). - CVE-2026-46598: golang.org/x/crypto/ssh: pathological inputs can lead to client panic/agent (bsc#1266191).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for buildah fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266648). - CVE-2026-39829: golang.org/x/crypto/ssh: pathological RSA/DSA parameters may cause DoS (bsc#1266191). - CVE-2026-39830: golang.org/x/crypto/ssh: client can cause server deadlock on unexpected responses (bsc#1266191). - CVE-2026-46598: golang.org/x/crypto/ssh: pathological inputs can lead to client panic/agent (bsc#1266191).
05 / REFERENCES