This advisory covers five security vulnerabilities in the skopeo tool and underlying Go libraries it depends on. The issues include: CVE-2025-61729, a denial of service via crafted certificates in crypto/x509; CVE-2025-61726, memory exhaustion in net/url query parameter parsing; CVE-2025-68121, unexpected TLS session resumption in crypto/tls; CVE-2026-25679, incorrect parsing of IPv6 host literals in net/url; and CVE-2026-34986, denial of service via crafted JSON Web Encryption objects in go-jose libraries. These vulnerabilities can lead to denial of service or incorrect behavior when processing network or cryptographic data. Red Hat has issued updated skopeo packages for Red Hat Enterprise Linux 10.0 Extended Update Support to remediate these issues.

The vulnerabilities can cause denial of service conditions through excessive resource consumption or memory exhaustion when processing crafted certificates, URLs, or JSON Web Encryption objects. Additionally, incorrect TLS session resumption and improper IPv6 parsing may lead to unexpected or incorrect behavior in secure communications. These issues affect the security and stability of systems using vulnerable versions of skopeo and its dependencies.

Red Hat has released updated skopeo packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply the official security update as described in the Red Hat advisory RHSA-2026:16696 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided update.