AZL-107880 CVE-2026-97032 affecting package skopeo 1.14.4-13

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107871 CVE-2026-78669 affecting package skopeo 1.14.4-13

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107868 CVE-2026-78659 affecting package skopeo 1.14.4-13

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107874 CVE-2026-78663 affecting package skopeo 1.14.4-13

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107877 CVE-2026-78660 affecting package skopeo 1.14.4-13

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107886 CVE-2026-107324 affecting package skopeo 1.14.4-13

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process,...

AZL-107865 CVE-2026-107325 affecting package skopeo 1.14.4-13

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an...

AZL-107883 CVE-2026-61801 affecting package skopeo 1.14.4-13

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

Important: Red Hat Security Advisory: skopeo security update

An update for skopeo is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

AlmaLinux 9.6 [TuxCare] Security Update: skopeo / skopeo-tests (ALMALINUX9.6:CLSA-2026:1776968105)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776968105 advisory. - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 Note that Nessus has not...

Rocky Linux 9.6 [TuxCare] Security Update: skopeo / skopeo-tests (ALMALINUX9.6:CLSA-2026:1782721550)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782721550 advisory. - Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number o...

Rocky Linux 9 [CIQ] Security Update: skopeo / skopeo-debuginfo / skopeo-debugsource / skopeo-tests Multiple Vulnerabilities (crlsa-2026_3340)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20263340 advisory. crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-61729 golang: net/url: Memory exhaustion in...

AlmaLinux 9.2 [TuxCare] Security Update: skopeo / skopeo-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1784302739)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784302739 advisory. - x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This...

Rocky Linux 8.6 [CIQ] Security Update: skopeo / skopeo-tests Multiple Vulnerabilities (ciqsa-2026_0259)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260259 advisory. This advisory aggregates security fixes for the skopeo SRPM in CIQ LTS 8.6. It addresses 38 CVEs: CVE-2018-25091, CVE-2024-34155, CVE-2021-33198,...

AlmaLinux 9.2 [TuxCare] Security Update: skopeo / skopeo-tests (ALMALINUX9.2:CLSA-2025:1762421840)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762421840 advisory. - A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry access...

RHEL 9 : skopeo (RHSA-2026:74581)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:74581 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify...

AlmaLinux 9.2 [TuxCare] Security Update: skopeo / skopeo-tests (ALMALINUX9.2:CLSA-2026:1790241517)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790241517 advisory. - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 Note that Nessus has not...

Rocky Linux 9.2 [CIQ] Security Update: skopeo / skopeo-tests Multiple Vulnerabilities (ciqsa-2026_1525)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261525 advisory. This advisory aggregates security fixes for the skopeo SRPM in CIQ LTS 9.2. It addresses 2 CVEs: CVE-2025-27144, CVE-2025-65637. Tenable has extracted th...

Rocky Linux 8.6 [CIQ] Security Update: skopeo / skopeo-tests Multiple Vulnerabilities (ciqsa-2026_1316)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261316 advisory. This advisory aggregates security fixes for the skopeo SRPM in CIQ LTS 8.6. It addresses 5 CVEs: CVE-2025-52881, CVE-2025-6032, CVE-2025-9566,...

Rocky Linux 10.0 [CIQ] Security Update: skopeo / skopeo-debuginfo / skopeo-debugsource / skopeo-tests (crlsa-2025_9149)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259149 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly...