The container-tools module in Red Hat Enterprise Linux 8.8 includes tools for container management, notably podman, buildah, skopeo, and runc. Two security vulnerabilities have been identified and fixed: CVE-2025-58183 involves unbounded memory allocation in the golang archive/tar package when parsing GNU sparse maps, potentially leading to resource exhaustion. CVE-2025-65637 is a denial-of-service vulnerability in the github.com/sirupsen/logrus logging library triggered by large single-line payloads. Red Hat has released updated packages as part of a security advisory (RHSA-2026:6191) to address these issues. The advisory rates the impact as moderate and provides instructions for applying the update.

The vulnerabilities could allow an attacker to cause resource exhaustion or denial-of-service conditions when processing specially crafted inputs related to container tools. Specifically, unbounded memory allocation in archive/tar could lead to excessive memory use, and the logrus vulnerability could cause denial-of-service through large payloads. There are no known exploits in the wild at this time. The impact is rated moderate by Red Hat.

Red Hat has released updated packages for the container-tools module in Red Hat Enterprise Linux 8.8 that fix these vulnerabilities. Users should apply the security update RHSA-2026:6191 as soon as possible to remediate these issues. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation depends on applying the vendor-provided patches. Patch status is confirmed by the vendor advisory.