Linux · openSUSE Leap · Security advisory · July 6, 2026

OPENSUSE-SU-2026:21244-1: podman security update

OPENSUSE-SU-2026:21244-1, released July 6, 2026, fixes 20 CVEs in podman (version 5.4.2-160000.5.1). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
20
1 rated Critical
Exploited
0
None reported
Highest CVSS
10.0
Base score, 0 to 10
Highest EPSS
0.0691
94th percentile

Priority of the 20 CVEs

Patch now 0 Urgent 1 High 16 Routine 3

Fixed package versions

ProductReleaseFixed in
podmanopensuse-leap 16.05.4.2-160000.5.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh10.0 0.0056 None reported
High CVE-2026-42508 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts9.1 0.0691 None reported
High CVE-2025-9566 Podman: podman kube play command may overwrite host files8.1 0.0121 None reported
High CVE-2025-22869 toolbox: The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Se...7.5 0.0094 None reported
High CVE-2025-52881 runc: LSM labels can be bypassed with malicious config using dummy procfs files8.2 0.0080 None reported
High CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh9.1 0.0068 None reported
High CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent9.1 0.0068 None reported
High CVE-2025-47913 Potential denial of service in golang.org/x/crypto/ssh/agent7.5 0.0067 None reported
High CVE-2026-34986 osbuild-composer: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood9.1 0.0066 None reported
High CVE-2026-39834 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh9.1 0.0060 None reported
High CVE-2025-6032 Podman: podman missing tls verification8.3 0.0052 None reported
High CVE-2026-39835 Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh8.7 0.0050 None reported
High CVE-2026-39831 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh9.1 0.0048 None reported
High CVE-2026-46597 Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh7.5 0.0047 None reported
High CVE-2026-39833 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent9.1 0.0047 None reported
High CVE-2026-39829 Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh8.7 0.0047 None reported
High CVE-2026-39828 Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh8.8 0.0037 None reported
Routine CVE-2025-47914 golang-go.crypto: SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the pro...5.3 0.0055 None reported
Routine CVE-2026-46598 Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent5.3 0.0041 None reported
Routine CVE-2026-39827 Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh6.5 0.0028 None reported
Showing 1 to 20 of 20 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.