The buildah package facilitates building OCI and Docker container images and has multiple security vulnerabilities stemming from underlying golang libraries. These include an SSH client panic caused by unexpected SSH_AGENT_SUCCESS messages, denial of service through excessive resource consumption from crafted certificates, memory exhaustion during URL query parameter parsing, improper TLS session resumption validation, and incorrect parsing of IPv6 host literals. These vulnerabilities affect Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. Red Hat Product Security has issued an advisory (RHSA-2026:11749) with updated buildah packages that fix these issues. The advisory rates the update as Important and provides detailed references for patching.

The vulnerabilities collectively could lead to denial of service conditions, memory exhaustion, unexpected client crashes, and incorrect TLS session handling when using buildah for container image building. These issues may disrupt container build operations or compromise the integrity of TLS sessions. No known exploits in the wild have been reported. The impact is rated as high by the source, indicating significant security concerns if unpatched.

Red Hat has released updated buildah packages for Red Hat Enterprise Linux 9.6 Extended Update Support and related variants that address these vulnerabilities. Users should apply the official Red Hat update as described in advisory RHSA-2026:11749 to remediate these issues. Detailed instructions and updated packages are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided patches.