The buildah package for Red Hat Enterprise Linux 10.0 EUS contains multiple denial of service vulnerabilities due to flaws in underlying Go libraries: CVE-2026-34986 involves a crafted JSON Web Encryption object causing DoS in github.com/go-jose/go-jose; CVE-2026-32281 and CVE-2026-32280 relate to inefficient or vulnerable certificate chain validation in crypto/x509; CVE-2026-32283 concerns denial of service via multiple TLS 1.3 key update messages in crypto/tls. These vulnerabilities can cause service disruption when processing malicious inputs. Red Hat has released updated buildah packages to remediate these issues.

Successful exploitation of these vulnerabilities can lead to denial of service conditions in applications using buildah for container image building, potentially disrupting container build operations. The issues arise from inefficient or vulnerable handling of cryptographic operations and JSON Web Encryption objects, which may cause resource exhaustion or application crashes. There is no indication of remote code execution or data disclosure. No known exploits in the wild have been reported.

Red Hat has released updated buildah packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:20569 and the referenced article https://access.redhat.com/articles/11258. Applying the official update is the recommended remediation. Patch status is confirmed by the vendor advisory.