A denial of service vulnerability (CVE-2026-34986) exists in the buildah package due to an issue in the Go JOSE library when processing crafted JSON Web Encryption (JWE) objects. This vulnerability can cause buildah to become unresponsive or crash when handling maliciously crafted JWE data. The issue has been addressed in buildah version 2:1.41.8-3.el9_7 and later.