The buildah package, used for building OCI and Docker container images, is affected by several security vulnerabilities originating from underlying Go libraries. These include CVE-2025-47913 (SSH client panic due to unexpected SSH_AGENT_SUCCESS), CVE-2025-61729 (denial of service via crafted certificate in crypto/x509), CVE-2025-61726 (memory exhaustion in net/url query parameter parsing), CVE-2025-68121 (unexpected TLS session resumption in crypto/tls), and CVE-2026-25679 (incorrect parsing of IPv6 host literals in net/url). Red Hat has released an important security update for buildah version 1.39.8-1.el10_0 to address these issues in Red Hat Enterprise Linux 10.0 Extended Update Support across multiple architectures.

Exploitation of these vulnerabilities could lead to denial of service conditions (via resource exhaustion or panic) and potential incorrect behavior in TLS session resumption and URL parsing, which may affect the security and stability of container image building processes. No known exploits in the wild have been reported. The vulnerabilities impact cryptographic and URL parsing components used by buildah, potentially disrupting container operations or causing unexpected failures.

Red Hat has released an updated buildah package version 1.39.8-1.el10_0 that addresses these vulnerabilities. Users of Red Hat Enterprise Linux 10.0 Extended Update Support should apply this official security update promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigations beyond applying the update are indicated by the vendor advisory.