The Red Hat buildah package, which facilitates building OCI container images, is affected by three denial of service vulnerabilities originating from Go libraries it depends on. CVE-2026-34986 affects the go-jose library allowing denial of service via crafted JSON Web Encryption objects. CVE-2026-32283 is a denial of service vulnerability triggered by multiple TLS 1.3 key update messages in the Go crypto/tls package. CVE-2026-32280 involves a denial of service flaw in certificate chain building within Go's crypto/x509 and crypto/tls packages. Red Hat has released updated buildah packages for Red Hat Enterprise Linux 9.6 Extended Update Support to fix these issues. The advisory references the Red Hat article for update instructions and lists the fixed package version as buildah-1.39.9-1.el9_6.

These vulnerabilities can cause denial of service conditions in buildah by exploiting flaws in underlying Go libraries related to JSON Web Encryption processing, TLS 1.3 key update handling, and certificate chain building. This could disrupt container image building processes or related operations using buildah. There are no reports of known exploits in the wild. The impact is rated as Important by Red Hat.

Red Hat has released updated buildah packages (version 1.39.9-1.el9_6) for Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply these updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official update.