The skopeo utility in Red Hat Enterprise Linux 10.0 is affected by three denial of service vulnerabilities in the underlying Go crypto libraries: CVE-2026-32280 and CVE-2026-32281 involve inefficient or vulnerable certificate chain validation in crypto/x509, and CVE-2026-32283 involves denial of service via multiple TLS 1.3 key update messages in crypto/tls. These flaws could be triggered during certificate chain building or TLS handshake processing, potentially causing skopeo to hang or crash. Red Hat has released updated skopeo packages (version 1.18.1-3.el10_0.2) to address these issues across multiple architectures including x86_64, s390x, ppc64le, and aarch64. The advisory references Red Hat's errata RHSA-2026:20571 for details and remediation instructions.

Successful exploitation of these vulnerabilities could cause denial of service conditions in skopeo by making it inefficient or unresponsive when validating certificate chains or processing TLS 1.3 key update messages. This could disrupt container image inspection and verification workflows that rely on skopeo. No evidence of active exploitation is reported.

Red Hat has released fixed skopeo packages for Red Hat Enterprise Linux 10.0 Extended Update Support. Users should apply the update as described in Red Hat advisory RHSA-2026:20571 and the referenced article https://access.redhat.com/articles/11258 to remediate these vulnerabilities. No additional mitigation steps are indicated by the vendor.