The buildah package for Red Hat Enterprise Linux 10.0 Extended Update Support contains multiple denial of service vulnerabilities originating from Go libraries. These include CVE-2026-34986 (Go JOSE: crafted JSON Web Encryption object), CVE-2026-32281 (inefficient certificate chain validation in crypto/x509), CVE-2026-32283 (multiple TLS 1.3 key update messages in crypto/tls), and CVE-2026-32280 (certificate chain building in crypto/x509 and crypto/tls). These flaws can be triggered to cause denial of service conditions. Red Hat has issued an important security advisory (RHSA-2026:20569) providing updated buildah packages (1.39.9-1.el10_0) that fix these issues. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. No known exploits in the wild have been reported. The vendor recommends applying the update as detailed in their official guidance.

Successful exploitation of these vulnerabilities can cause denial of service conditions in the buildah tool, potentially disrupting container image building processes. The issues arise from inefficient or improper handling of certificate validation and TLS key update messages, as well as crafted JSON Web Encryption objects. There is no indication of privilege escalation, code execution, or data disclosure. No known active exploitation has been reported.

Red Hat has released updated buildah packages (version 1.39.9-1.el10_0) that address these denial of service vulnerabilities. Users should apply the security update provided in Red Hat Enterprise Linux 10.0 Extended Update Support as soon as possible. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the official patch.