The skopeo command, used for inspecting container images and verifying signatures, was affected by several security vulnerabilities in its underlying Go libraries and dependencies. These include a denial of service via crafted certificates (CVE-2025-61729), memory exhaustion in query parameter parsing (CVE-2025-61726), unexpected TLS session resumption (CVE-2025-68121), incorrect parsing of IPv6 host literals (CVE-2026-25679), and denial of service via crafted JSON Web Encryption objects (CVE-2026-34986). Red Hat released security updates for skopeo in Red Hat Enterprise Linux 10.0 Extended Update Support and OpenShift Container Platform 4.16 to address these vulnerabilities. The advisory includes updated RPM packages and container images across multiple architectures (x86_64, s390x, ppc64le, aarch64).

Successful exploitation of these vulnerabilities could lead to denial of service conditions due to excessive resource consumption or memory exhaustion, potentially impacting availability of the skopeo tool and related container image operations. Incorrect parsing of IPv6 literals and unexpected TLS session resumption could lead to security validation issues, possibly affecting secure communications. No known exploits in the wild have been reported at this time.

Red Hat has released official security updates for skopeo and related components in Red Hat Enterprise Linux 10.0 Extended Update Support and OpenShift Container Platform 4.16. Users should apply these updates promptly by following Red Hat's published guidance at https://access.redhat.com/articles/11258 and the OpenShift upgrade instructions at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli. The updated packages and container images address all listed CVEs. No additional mitigation actions are required beyond applying these official fixes.