This Red Hat security advisory addresses multiple vulnerabilities in podman for RHEL 9, rated Important, including critical and high-severity flaws in the golang crypto library (CVE-2026-39832, CVSS 9.1; CVE-2026-39829, CVSS 7.5) that allow denial of service, security bypass, and revocation bypass via crafted SSH certificates and keys. The underlying golang crypto library vulnerabilities affect versions prior to 0.52.0. The update also resolves a podman-specific information disclosure vulnerability (CVE-2026-57231) via malicious container images and includes several bug fixes.
Red Hat Product Errata RHSA-2026:37123 - Security Advisory Issued: 2026-07-09 Updated: 2026-07-09 RHSA-2026:37123 - Security Advisory Overview Updated Packages Synopsis Important: podman security, bug fix, and enhancement update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for podman is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835) golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832) golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508) golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231) Bug Fix(es) and Enhancement(s): podman does not clean up all files and leaves orphaned files consuming disk space [rhel-9.8.z] (JIRA:RHEL-173988) [FJ9.8 Bug]: [REG]The "podman-remote save" command fails for rootless users. [rhel-9.8.z] (JIRA:RHEL-192439) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2480680 - CVE-2026-39835 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate BZ - 2480681 - CVE-2026-39829 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters BZ - 2480685 - CVE-2026-39832 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions BZ - 2480688 - CVE-2026-42508 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey BZ - 2480757 - CVE-2026-27136 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass BZ - 2480761 - CVE-2026-25681 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting BZ - 2493620 - CVE-2026-57231 podman: Podman: Information disclosure via malicious container image environment variables CVEs CVE-2026-25681 CVE-2026-27136 CVE-2026-39829 CVE-2026-39832 CVE-2026-39835 CVE-2026-42508 CVE-2026-57231 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM podman-5.8.2-4.el9_8.src.rpm SHA-256: eb2b89d180ab45fd62f06f8e20441547e0b4baa16c1c3820eefc0596e4becfc6 x86_64 podman-5.8.2-4.el9_8.x86_64.rpm SHA-256: fbe540aeb22358c54264ac64fac2d6962d9d735bb3ef6b83ea550ade29847337 podman-debuginfo-5.8.2-4.el9_8.x86_64.rpm SHA-256: 6c5fb9a986d75a15afbbc8409a4ec6dfb5545867b1d93bdb63167eccfea3c581 podman-debugsource-5.8.2-4.el9_8.x86_64.rpm SHA-256: bab2077ecd807aaf838b570e4cd1cb633301cc4423e042850561eaf2ff3436e6 podman-docker-5.8.2-4.el9_8.noarch.rpm SHA-256: 4c361a0eaa718549d7990ab854e8ded3be9083aeda6f5256367cddfab9e1f955 podman-plugins-5.8.2-4.el9_8.x86_64.rpm SHA-256: f69671d2f1e332c6aed74f1bed0602de0254004b42480a24b1730dfd171e3266 podman-plugins-debuginfo-5.8.2-4.el9_8.x86_64.rpm SHA-256: 604a7c1d8471d82ea9eccec531d6aee81b48a2ae2fbf882013b647037e177339 podman-remote-5.8.2-4.el9_8.x86_64.rpm SHA-256: afbb5f10d20ff26a5a3cffa88a127e447183e6460f7318ac44d78ad5bea64035 podman-remote-debuginfo-5.8.2-4.el9_8.x86_64.rpm SHA-256: c17f3f391e5b442519c2263ca786b27f3c595e5407718b619389869199c1e531 podman-tests-5.8.2-4.el9_8.x86_64.rpm SHA-256: db0eba0390ad5100b788230ab0504a582b3aa32c0753195dbc05fc4076616f5c podman-tests-debuginfo-5.8.2-4.el9_8.x86_64.rpm SHA-256: 0a4e245046b249ed48bc23cdb8d6d87bb7f711e6a337a0b2a118961a9e7f3cdc Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 SRPM podman-5.8.2-4.el9_8.src.rpm SHA-256: eb2b89d180ab45fd62f06f8e20441547e0b4baa16c1c3820eefc0596e4becfc6 x86_64 podman-5.8.2-4.el9_8.x86_64.rpm SHA-256: fbe540aeb22358c54264ac64fac2d6962d9d735bb3ef6b83ea550ade29847337 podman-debuginfo-5.8.2-4.el9_8.x86_64.rpm SHA-256: 6c5fb9a986d75a15afbbc8409a4ec6dfb5545867b1d93bdb63167eccfea3c581 podman-debugsource-5.8.2-4.el9_8.x86_64.rpm SHA-256: bab2077ecd807aaf838b570e4cd1cb633301cc4423e042850561eaf2ff3436e6 podman-docker-5.8.2-4.el9_8.noarch.rpm SHA-256: 4c361a0eaa718549d7990ab854e8ded3be9083aeda6f5256367cddfab9e1f955 podman-plugins-5.8.2-4.el9_8.x86_64.rpm SHA-256: f69671d2f1e332c6aed74f1bed0602de0254004b42480a24b1730dfd171e3266 podman-plugins-debuginfo-5.8.2-4.el9_8.x86_64.rpm SHA-256: 604a7c1d8471d82ea9eccec531d6aee81b48a2ae2fbf882013b647037e177339 podman-remote-5.8.2-4.el9_8.x86_64.rpm SHA-256: afbb5f10d20ff26a5a3cffa88a127e447183e6460f7318ac44d78ad5bea64035 podman-remote-debuginfo-5.8.2-4.el9_8.x86_64.rpm SHA-256: c17f3f391e5b442519c2263ca786b27f3c595e5407718b619389869199c1e531 podman-tests-5.8.2-4.el9_8.x86_64.rpm SHA-256: db0eba0390ad5100b788230ab0504a582b3aa32c0753195dbc05fc4076616f5c podman-tests-debuginfo-5.8.2-4.el9_8.x86_64.rpm SHA-256: 0a4e245046b249ed48bc23cdb8d6d87bb7f711e6a337a0b2a118961a9e7f3cdc Red Hat Enterprise Linux for IBM z Systems 9 SRPM podman-5.8.2-4.el9_8.src.rpm SHA-256: eb2b89d180ab45fd62f06f8e20441547e0b4baa16c1c3820eefc0596e4becfc6 s390x podman-5.8.2-4.el9_8.s390x.rpm SHA-256: 2518f9cfae6b95981da4b57fd2e55de86ea813a065afaea787c28982ced66657 podman-debuginfo-5.8.2-4.el9_8.s390x.rpm SHA-256: 532cf1b2092a747eb662600c1f37b21d69d1b7aef27247c498f4ae50c98b43bc podman-debugsource-5.8.2-4.el9_8.s390x.rpm SHA-256: fc5edeeeb93632ebb8c930e004275aa16ceaf3b03d6ad32798cacf2d1c8ba934 podman-docker-5.8.2-4.el9_8.noarch.rpm SHA-256: 4c361a0eaa718549d7990ab854e8ded3be9083aeda6f5256367cddfab9e1f955 podman-plugins-5.8.2-4.el9_8.s390x.rpm SHA-256: a1587f596dd7063eea1197ea97123f6306f546bb664af8981f43e72349134c87 podman-plugins-debuginfo-5.8.2-4.el9_8.s390x.rpm SHA-256: 1d92a346cbd4c9438bd7fc2cb446ec83ef7d57772a8b8965b33279fb049a4283 podman-remote-5.8.2-4.el9_8.s390x.rpm SHA-256: b4ee8785b45d9e78d3b4d8af053f7e12c8df299f73c5064dc6233a0d1cf7fe72 podman-remote-debuginfo-5.8.2-4.el9_8.s390x.rpm SHA-256: 5e3eb915684dea8f64163a7e07644a2615c13ac0e32c853a7d1583138e53e79b podman-tests-5.8.2-4.el9_8.s390x.rpm SHA-256: 98ff78d3917890359d803fadb54ee56eff6c48dda81385ed6ca3b0d46857ca0c podman-tests-debuginfo-5.8.2-4.el9_8.s390x.rpm SHA-256: c11ab671b1222f5e77540159b759cea5359162069b6df36d0320f7c4622d9401 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 SRPM podman-5.8.2-4.el9_8.src.rpm SHA-256: eb2b89d180ab45fd62f06f8e20441547e0b4baa16c1c3820eefc0596e4becfc6 s390x podman-5.8.2-4.el9_8.s390x.rpm SHA-256: 2518f9cfae6b95981da4b57fd2e55de86ea813a065afaea787c28982ced66657 podman-debuginfo-5.8.2-4.el9_8.s390x.rpm SHA-256: 532cf1b2092a747eb662600c1f37b21d69d1b7aef27247c498f4ae50c98b43bc podman-debugsource-5.8.2-4.el9_8.s390x.rpm SHA-256: fc5edeeeb93632ebb8c930e004275aa16ceaf3b03d6ad32798cacf2d1c8ba934 podman-docker-5.8.2-4.el9_8.noarch.rpm SHA-256: 4c361a0eaa718549d7990ab854e8ded3be9083aeda6f5256367cddfab9e1f955 podman-plugins-5.8.2-4.el9_8.s390x.rpm SHA-256: a1587f596dd7063eea1197ea97123f6306f546bb664af8981f43e72349134c87 podman-plugins-debuginfo-5.8.2-4.el9_8.s390x.rpm SHA-256: 1d92a346cbd4c9438bd7fc2cb446ec83ef7d57772a8b8965b33279fb049a4283 podman-remote-5.8.2-4.el9_8.s390x.rpm SHA-256: b4ee8785b45d9e78d3b4d8af053f7e12c8df299f73c5064dc6233a0d1cf7fe72 podman-remote-debuginfo-5.8.2-4.el9_8.s390x.rpm SHA-256: 5e3eb915684dea8f64163a7e07644a2615c13ac0e32c853a7d1583138e53e79b podman-tests-5.8.2-4.el9_8.s390x.rpm SHA-256: 98ff78d3917890359d803fadb54ee56eff6c48