The Red Hat security advisory RHSA-2026:3340 addresses three vulnerabilities in the skopeo command, which inspects container images and handles image signatures. CVE-2025-61729 is a denial of service vulnerability caused by excessive resource consumption triggered by crafted certificates in the crypto/x509 package. CVE-2025-61726 involves memory exhaustion during query parameter parsing in the golang net/url package. CVE-2025-68121 concerns unexpected session resumption in the crypto/tls package. These vulnerabilities could lead to resource exhaustion or unexpected TLS behavior when processing untrusted inputs. The advisory provides updated skopeo packages for Red Hat Enterprise Linux 9 and related variants.

These vulnerabilities can cause denial of service conditions through excessive resource consumption or memory exhaustion, potentially disrupting the normal operation of the skopeo command. The unexpected TLS session resumption could lead to unexpected cryptographic behavior, which may affect the security of TLS connections established by skopeo. No known exploits in the wild have been reported at this time.

Red Hat has released updated skopeo packages for Red Hat Enterprise Linux 9 and its variants that address these vulnerabilities. Users should apply the official security update RHSA-2026:3340 promptly to remediate these issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.