Red Hat Product Errata RHSA-2026:33722 - Security Advisory Issued: 2026-06-30 Updated: 2026-06-30 RHSA-2026:33722 - Security Advisory Overview Updated Packages Synopsis Important: container-tools:rhel8 security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) Bug Fix(es) and Enhancement(s): user_u SELinux user can't run podman containers as rootless (JIRA:RHEL-135342) podman does not clean up all files and leaves orphaned files consuming disk space [rhel-8.10.z] (JIRA:RHEL-173978) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2445356 - CVE-2026-25679 net/url: Incorrect parsing of IPv6 host literals in net/url BZ - 2455470 - CVE-2026-34986 github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object BZ - 2456333 - CVE-2026-32281 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation BZ - 2456338 - CVE-2026-32283 crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages BZ - 2456339 - CVE-2026-32280 crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVEs CVE-2026-25679 CVE-2026-32280 CVE-2026-32281 CVE-2026-32283 CVE-2026-34986 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM aardvark-dns-1.10.1-2.module+el8.10.0+24321+617e8352.src.rpm SHA-256: e58c2df5ae12c1463c368568da600bdb2c728e6861238d04b468e8f30d829672 buildah-1.33.14-3.module+el8.10.0+24321+617e8352.src.rpm SHA-256: fa366d6f24d309f05b8334c5d805c89bd71ea897abaac1311f9e18e604ed42e6 cockpit-podman-84.1-1.module+el8.10.0+24321+617e8352.src.rpm SHA-256: 884c7835a303587ed0e5cc9ae86e78e72813a240ad0d6beb1a4cebab7dfa194e conmon-2.1.10-1.module+el8.10.0+24321+617e8352.src.rpm SHA-256: 501171184b4882a9a1772c9006d797352f5d0fce02a7a106893dee3af6184959 container-selinux-2.229.0-3.module+el8.10.0+24321+617e8352.src.rpm SHA-256: c5d39864dd2eda382a00a2d3f8e47a50095286f9eb9756f135696b021670d212 containernetworking-plugins-1.4.0-8.module+el8.10.0+24321+617e8352.src.rpm SHA-256: 6471f9b596e3de1bf945526b5189a0ff99ca65f6a84c0fa7d2d52324946d9d06 containers-common-1-82.module+el8.10.0+24321+617e8352.src.rpm SHA-256: 70060a85c0e4becdb6e4fe411043c71e01482f1ac23f1f021ad86237457d00bd criu-3.18-5.module+el8.10.0+24321+617e8352.src.rpm SHA-256: 1d431a1fd5461d5634d4a931a15457b2c55710c9b852b6126fefee0e585efec5 crun-1.14.3-2.module+el8.10.0+24321+617e8352.src.rpm SHA-256: 0bd21e88428aa91e012c3b933d88af99101250868df99225bf6bf4329ed8e37a fuse-overlayfs-1.13-1.module+el8.10.0+24321+617e8352.src.rpm SHA-256: 190e5aad4a9dee2fd6590fc6e834e772b361d0cd007a3a1538ca10494c3dd5a4 libslirp-4.4.0-2.module+el8.10.0+24321+617e8352.src.rpm SHA-256: 25e2cf40caacea544463c3906c0337598f240d9369fb7b896e4e4be4662139a0 netavark-1.10.3-1.module+el8.10.0+24321+617e8352.src.rpm SHA-256: 1cb64e4f683774db23d03adc2b313a8cfefd20f539c521de6af2a41edbe6e725 oci-seccomp-bpf-hook-1.2.10-1.module+el8.10.0+24321+617e8352.src.rpm SHA-256: d6830c93657c25ae980bc4818b6f9db69487a21bc46f4336fdde7fbb65b21e63 podman-4.9.4-31.module+el8.10.0+24321+617e8352.src.rpm SHA-256: fb198a4d673e8fa7724bfa432c1b99c5f0f3ac1f214623d8e78c64d2c51666a0 python-podman-4.9.0-3.module+el8.10.0+24321+617e8352.src.rpm SHA-256: 662c8ea5a29cb5a3c6d05387098ce07c7902a5e3fb630654684f23fa27329904 runc-1.2.9-4.module+el8.10.0+24321+617e8352.src.rpm SHA-256: 8ae85c98a3b1f3865485f656a4a10d46cbc12515a9ae2c0fe56492025d58e3d8 skopeo-1.14.6-2.module+el8.10.0+24321+617e8352.src.rpm SHA-256: e0610df3399db7b613a111d15112872f38207c279fc71613ac7e83944dd7771f slirp4netns-1.2.3-1.module+el8.10.0+24321+617e8352.src.rpm SHA-256: 3d7302eb9d25b272613ca4ada6cec2f6625e8fb4681b27a5f9b4bd15fb4f2fb7 toolbox-0.0.99.5.1-1.module+el8.10.0+24321+617e8352.src.rpm SHA-256: bbeb6b9ccafa1f6ed3e40fd08c20c138a411c48f3a979fa2e013549b7d0a394f udica-0.2.6-21.module+el8.10.0+24321+617e8352.src.rpm SHA-256: 4ae7ac8c1440e07fd9b46c28b156aefa864b14468214ec8aaf9c8dce840f892d x86_64 cockpit-podman-84.1-1.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: 3383f46bea498108431ddfe7d7559c26e3984d3538daa1103641359ea6ee436a container-selinux-2.229.0-3.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: db5426b40b3912b0609f89ba6cb7bc2a340fc00f903c45baaa4afcf3b8b0962c podman-docker-4.9.4-31.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: 21c80abdd9830b33172811c5492b643b4d27fe1e2a71c15fc5925fac29b95e3f python3-podman-4.9.0-3.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: 3370b01b1448afc47bfa15294244db5544983433b293d542ff1db18c44816fcc udica-0.2.6-21.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: cd402b3a84a597baa145da13de4f0d2c45702d8b059416a3c610c097a8ece8e6 cockpit-podman-84.1-1.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: 3383f46bea498108431ddfe7d7559c26e3984d3538daa1103641359ea6ee436a container-selinux-2.229.0-3.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: db5426b40b3912b0609f89ba6cb7bc2a340fc00f903c45baaa4afcf3b8b0962c podman-docker-4.9.4-31.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: 21c80abdd9830b33172811c5492b643b4d27fe1e2a71c15fc5925fac29b95e3f python3-podman-4.9.0-3.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: 3370b01b1448afc47bfa15294244db5544983433b293d542ff1db18c44816fcc udica-0.2.6-21.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: cd402b3a84a597baa145da13de4f0d2c45702d8b059416a3c610c097a8ece8e6 cockpit-podman-84.1-1.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: 3383f46bea498108431ddfe7d7559c26e3984d3538daa1103641359ea6ee436a container-selinux-2.229.0-3.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: db5426b40b3912b0609f89ba6cb7bc2a340fc00f903c45baaa4afcf3b8b0962c podman-docker-4.9.4-31.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: 21c80abdd9830b33172811c5492b643b4d27fe1e2a71c15fc5925fac29b95e3f python3-podman-4.9.0-3.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: 3370b01b1448afc47bfa15294244db5544983433b293d542ff1db18c44816fcc udica-0.2.6-21.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: cd402b3a84a597baa145da13de4f0d2c45702d8b059416a3c610c097a8ece8e6 aardvark-dns-1.10.1-2.module+el8.10.0+24321+617e8352.x86_64.rpm SHA-256: ff075f52c7e734b98a4833f83cd2a1ed02f29b25ac2dd42899c93222d887f53e buildah-1.33.14-3.module+el8.10.0+24321+617e8352.x86_64.rpm SHA-256: 33070a1f585377e8561135f8e03746e447535e2daab468bb691454ea49ba0d82 buildah-debuginfo-1.33.14-3.module+el8.10.0+24321+617e8352.x86_64.rpm SHA-256: 223b096b63b3be7f1478fe59260ae6fb96162fbbc1f8766ba352b8a223c3ca70 buildah-debugsource-1.33.14-3.module+el8.10.0+24321+617e8352.x86_64.rpm SHA-256: f701f5444170fdad3a2175c3c4218cd100dc7657549693c94d26d5c7e5da32a7 buildah-tests-1.33.14-3.module+el8.10.0+24321+617e8352.x86_64.rpm SHA-256: f4c99af28903b39f1672f499d6ad3d9c61a80b799f43acaf4ba0166cab37388a buildah-tests-debuginfo-1.33.14-3.module+el8.10.0+24321+617e8352.x86_64.rpm SHA-256: 271dbf8e7443ad3e3536a33b9565ced94ffb3d8c5b47ae8baf1232cf70e119fc cockpit-podman-84.1-1.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: 3383f46bea498108431ddfe7d7559c26e3984d3538daa1103641359ea6ee436a conmon-2.1.10-1.module+el8.10.0+24321+617e8352.x86_64.rpm SHA-256: 2751faa7f2266510ffafbcc2c78b3dc7c63784e06a71727f761ddd0d551070c4 conmon-debuginfo-2.1.10-1.module+el8.10.0+24321+617e8352.x86_64.rpm SHA-256: 2adc38ea83a12095a9d3c283b1c1223d156c1c7ede2fbccc88735f160301cac7 conmon-debugsource-2.1.10-1.module+el8.10.0+24321+617e8352.x86_64.rpm SHA-256: 9c1db4d636e41854fda49471eea7992f70d7c8c5d5202d499babba65e9c891d4 container-selinux-2.229.0-3.module+el8.10.0+24321+617e8352.noarch.rpm SHA-256: db5426b40b3912b0609f89ba6cb7bc2a340fc00f903c45baaa4afcf3b8b0962c containernetworking-plugins-1.4.0-8.module+el8.10.0+24321+617e8352.x86_64.rpm SHA-256: 49900beb29c7fd115d4cae16ec621ff2d6c087071e3ce1be1ae539d5b69c5ece containernetworking-plugi