This advisory covers two security vulnerabilities affecting podman and its dependencies on Red Hat Enterprise Linux 10.0 Extended Update Support. CVE-2025-52881 is a container escape and denial of service vulnerability in runc caused by arbitrary write gadgets and procfs write redirects, potentially allowing an attacker to break container isolation. CVE-2025-58183 is an unbounded memory allocation vulnerability in the golang archive/tar package when parsing GNU sparse maps, which could lead to denial of service. Red Hat has released updated podman packages that address these issues. The advisory references Red Hat bugzilla entries and provides package updates for multiple architectures. The vendor rates the security impact as Important and recommends applying the update. No CVSS scores are provided in the advisory.

The vulnerabilities could allow an attacker to escape container isolation and cause denial of service conditions. CVE-2025-52881 affects runc, a core container runtime component, enabling container escape and denial of service through arbitrary write operations and procfs write redirects. CVE-2025-58183 could cause unbounded memory allocation leading to denial of service when processing specially crafted tar archives. These issues impact container security and system stability on affected Red Hat Enterprise Linux 10.0 Extended Update Support systems. No known active exploitation has been reported.

Red Hat has released updated podman packages that fix these vulnerabilities. Users of Red Hat Enterprise Linux 10.0 Extended Update Support and related CodeReady Linux Builder versions should apply the provided security updates promptly. Detailed update instructions are available in the Red Hat advisory and knowledge base article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by Red Hat beyond applying the official patches.