Linux · Security advisory · August 18, 2026

RHSA-2026:70201: podman security update

RHSA-2026:70201, released August 18, 2026, fixes 11 CVEs in podman (version 5.8.2-9.el10_2). None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
11
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0080
56th percentile

Priority of the 11 CVEs

Patch now 0 Urgent 0 High 11 Routine 0

Fixed package versions

ProductReleaseFixed in
podmanRHEL 105.8.2-9.el10_2

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-42499 Quadratic string concatenation in consumePhrase in net/mail 8.8 0.0080 None reported
High CVE-2026-33818 Enforce maximum recursion depth in encoding/asn1 8.8 0.0057 None reported
High CVE-2026-56853 Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http 8.8 0.0057 None reported
High CVE-2026-56859 Add recursion depth guard during decode in encoding/xml 8.8 0.0057 None reported
High CVE-2026-56862 Limit handshake messages we are willing to accept post-handshake in crypto/tls 8.8 0.0057 None reported
High CVE-2026-56860 Avoid quadratic complexity in resolvePath in net/url 8.8 0.0055 None reported
High CVE-2026-56852 Infinite loop on invalid input in golang.org/x/text 8.8 0.0048 None reported
High CVE-2026-17106 Tar extraction in moby/go-archive can write outside the destination directory via link following 8.8 0.0044 None reported
High CVE-2026-33810 Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 9.1 0.0035 None reported
High CVE-2026-56858 Fix Javascript regexp context tracking in html/template 8.8 0.0031 None reported
High CVE-2026-19730 podman: The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O... 8.8 0.0013 None reported
Showing 1 to 11 of 11 1