The buildah package, which facilitates building OCI container images on Red Hat Enterprise Linux 9.0, contains multiple vulnerabilities stemming from underlying Go libraries. These include CVE-2025-47913 (SSH client panic due to unexpected SSH_AGENT_SUCCESS), CVE-2025-61729 (denial of service via crafted certificates in crypto/x509), CVE-2025-61726 (memory exhaustion in net/url query parsing), CVE-2025-68121 (unexpected TLS session resumption), CVE-2026-25679 (incorrect IPv6 host literal parsing in net/url), and CVE-2026-32283 (denial of service via multiple TLS 1.3 key update messages). Red Hat has issued an important security advisory (RHSA-2026:16102) with updated packages addressing these vulnerabilities.

These vulnerabilities can lead to denial of service conditions through resource exhaustion or unexpected behavior in SSH and TLS sessions, potentially disrupting container image building processes. Incorrect parsing of network addresses and TLS session resumption could also affect the security and stability of applications relying on buildah. No known exploits in the wild have been reported. The impact is rated as high by Red Hat Product Security.

Red Hat has released updated buildah packages for Red Hat Enterprise Linux 9.0 and related variants that address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2026:16102 and the referenced article https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires manual update of the affected packages. There are no indications that no action is required or that these issues are already mitigated without patching.