rpm package
almalinux/crun
pkg:rpm/almalinux/crun
Vulnerabilities (112)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-56862 | Hig | 7.5 | < 1.14.3-4.module_el8.10.0+4269+94686149 | 1.14.3-4.module_el8.10.0+4269+94686149 | Aug 13, 2026 | Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indef | |
| CVE-2026-56860 | Med | 5.9 | < 1.14.3-4.module_el8.10.0+4269+94686149 | 1.14.3-4.module_el8.10.0+4269+94686149 | Aug 13, 2026 | Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-b | |
| CVE-2026-56859 | Hig | 7.5 | < 1.14.3-4.module_el8.10.0+4269+94686149 | 1.14.3-4.module_el8.10.0+4269+94686149 | Aug 13, 2026 | Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. | |
| CVE-2026-56858 | Med | 6.1 | < 1.14.3-4.module_el8.10.0+4269+94686149 | 1.14.3-4.module_el8.10.0+4269+94686149 | Aug 13, 2026 | Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. | |
| CVE-2026-56853 | Hig | 7.5 | < 1.14.3-4.module_el8.10.0+4269+94686149 | 1.14.3-4.module_el8.10.0+4269+94686149 | Aug 13, 2026 | When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. | |
| CVE-2026-33818 | Hig | 7.5 | < 1.14.3-4.module_el8.10.0+4269+94686149 | 1.14.3-4.module_el8.10.0+4269+94686149 | Aug 13, 2026 | Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. | |
| CVE-2026-57231 | Hig | 7.5 | < 1.14.3-2.module_el8.10.0+4120+03ad4b47 | 1.14.3-2.module_el8.10.0+4120+03ad4b47 | Jun 26, 2026 | Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that usi | |
| CVE-2026-42508 | Cri | 9.1 | < 1.14.3-2.module_el8.10.0+4120+03ad4b47 | 1.14.3-2.module_el8.10.0+4120+03ad4b47 | May 22, 2026 | Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked. | |
| CVE-2026-39835 | Med | 5.3 | < 1.14.3-2.module_el8.10.0+4120+03ad4b47 | 1.14.3-2.module_el8.10.0+4120+03ad4b47 | May 22, 2026 | SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil. | |
| CVE-2026-39832 | Cri | 9.1 | < 1.14.3-2.module_el8.10.0+4120+03ad4b47 | 1.14.3-2.module_el8.10.0+4120+03ad4b47 | May 22, 2026 | When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now | |
| CVE-2026-39830 | Cri | 9.1 | < 1.14.3-2.module_el8.10.0+4120+03ad4b47 | 1.14.3-2.module_el8.10.0+4120+03ad4b47 | May 22, 2026 | A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now | |
| CVE-2026-39829 | Hig | 7.5 | < 1.14.3-2.module_el8.10.0+4120+03ad4b47 | 1.14.3-2.module_el8.10.0+4120+03ad4b47 | May 22, 2026 | The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clien | |
| CVE-2026-42499 | Hig | 7.5 | < 1.14.3-4.module_el8.10.0+4269+94686149 | 1.14.3-4.module_el8.10.0+4269+94686149 | May 7, 2026 | Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. | |
| CVE-2026-33811 | Hig | 7.5 | < 1.14.3-2.module_el8.10.0+4120+03ad4b47 | 1.14.3-2.module_el8.10.0+4120+03ad4b47 | May 7, 2026 | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. | |
| CVE-2026-32283 | Hig | 7.5 | < 1.14.3-2.module_el8.10.0+4120+03ad4b47 | 1.14.3-2.module_el8.10.0+4120+03ad4b47 | Apr 8, 2026 | If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3. | |
| CVE-2026-32281 | Hig | 7.5 | < 1.14.3-2.module_el8.10.0+4120+03ad4b47 | 1.14.3-2.module_el8.10.0+4120+03ad4b47 | Apr 8, 2026 | Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root C | |
| CVE-2026-32280 | Hig | 7.5 | < 1.14.3-2.module_el8.10.0+4120+03ad4b47 | 1.14.3-2.module_el8.10.0+4120+03ad4b47 | Apr 8, 2026 | During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls | |
| CVE-2026-34986 | Hig | 7.5 | < 1.14.3-2.module_el8.10.0+4120+03ad4b47 | 1.14.3-2.module_el8.10.0+4120+03ad4b47 | Apr 6, 2026 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JW | |
| CVE-2026-30892 | Non | 0.0 | < 1.27-2.el10_2 | 1.27-2.el10_2 | Mar 26, 2026 | crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with hig | |
| CVE-2026-25679 | Hig | 7.5 | < 1.14.3-2.module_el8.10.0+4120+03ad4b47 | 1.14.3-2.module_el8.10.0+4120+03ad4b47 | Mar 6, 2026 | url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. |
- affected < 1.14.3-4.module_el8.10.0+4269+94686149fixed 1.14.3-4.module_el8.10.0+4269+94686149
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indef
- affected < 1.14.3-4.module_el8.10.0+4269+94686149fixed 1.14.3-4.module_el8.10.0+4269+94686149
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-b
- affected < 1.14.3-4.module_el8.10.0+4269+94686149fixed 1.14.3-4.module_el8.10.0+4269+94686149
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
- affected < 1.14.3-4.module_el8.10.0+4269+94686149fixed 1.14.3-4.module_el8.10.0+4269+94686149
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
- affected < 1.14.3-4.module_el8.10.0+4269+94686149fixed 1.14.3-4.module_el8.10.0+4269+94686149
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
- affected < 1.14.3-4.module_el8.10.0+4269+94686149fixed 1.14.3-4.module_el8.10.0+4269+94686149
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
- affected < 1.14.3-2.module_el8.10.0+4120+03ad4b47fixed 1.14.3-2.module_el8.10.0+4120+03ad4b47
Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that usi
- affected < 1.14.3-2.module_el8.10.0+4120+03ad4b47fixed 1.14.3-2.module_el8.10.0+4120+03ad4b47
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
- affected < 1.14.3-2.module_el8.10.0+4120+03ad4b47fixed 1.14.3-2.module_el8.10.0+4120+03ad4b47
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
- affected < 1.14.3-2.module_el8.10.0+4120+03ad4b47fixed 1.14.3-2.module_el8.10.0+4120+03ad4b47
When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now
- affected < 1.14.3-2.module_el8.10.0+4120+03ad4b47fixed 1.14.3-2.module_el8.10.0+4120+03ad4b47
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now
- affected < 1.14.3-2.module_el8.10.0+4120+03ad4b47fixed 1.14.3-2.module_el8.10.0+4120+03ad4b47
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clien
- affected < 1.14.3-4.module_el8.10.0+4269+94686149fixed 1.14.3-4.module_el8.10.0+4269+94686149
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
- affected < 1.14.3-2.module_el8.10.0+4120+03ad4b47fixed 1.14.3-2.module_el8.10.0+4120+03ad4b47
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
- affected < 1.14.3-2.module_el8.10.0+4120+03ad4b47fixed 1.14.3-2.module_el8.10.0+4120+03ad4b47
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
- affected < 1.14.3-2.module_el8.10.0+4120+03ad4b47fixed 1.14.3-2.module_el8.10.0+4120+03ad4b47
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root C
- affected < 1.14.3-2.module_el8.10.0+4120+03ad4b47fixed 1.14.3-2.module_el8.10.0+4120+03ad4b47
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls
- affected < 1.14.3-2.module_el8.10.0+4120+03ad4b47fixed 1.14.3-2.module_el8.10.0+4120+03ad4b47
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JW
- affected < 1.27-2.el10_2fixed 1.27-2.el10_2
crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with hig
- affected < 1.14.3-2.module_el8.10.0+4120+03ad4b47fixed 1.14.3-2.module_el8.10.0+4120+03ad4b47
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
Page 1 of 6