A Denial of Service vulnerability (CVE-2026-34986, CVSS 7.5 HIGH) exists in the go-jose library where a crafted JSON Web Encryption (JWE) object can trigger a panic. This affects podman on RHEL 9 due to its dependency on go-jose versions 3.0.0 through 3.0.4 and 4.0.0 through 4.1.3. The fix requires updating the underlying go-jose library to version 3.0.5 or 4.1.4, which is provided by the Red Hat podman security update.
Red Hat Product Errata RHSA-2026:19173 - Security Advisory Issued: 2026-05-19 Updated: 2026-05-19 RHSA-2026:19173 - Security Advisory Overview Updated Packages Synopsis Important: podman security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for podman is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2455470 - CVE-2026-34986 github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVEs CVE-2026-34986 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM podman-5.8.2-1.el9_8.src.rpm SHA-256: 04248396decb9142d5bc4558e199ce9dcecf671f1533d36bd369accf45fdb4fc x86_64 podman-5.8.2-1.el9_8.x86_64.rpm SHA-256: 3dd516752c9e6c56d7b377a5b75f4bfb9d5133bc884fb26f26d8bfa7fd649ce4 podman-debuginfo-5.8.2-1.el9_8.x86_64.rpm SHA-256: 06958a1a48581368d294ee026285c50799bfbd4fbe120739a72c6c20b069a3bc podman-debugsource-5.8.2-1.el9_8.x86_64.rpm SHA-256: bc20cb6e485072d0050e942c4420853edb138ab8704dd7aa2331501ccac8238f podman-docker-5.8.2-1.el9_8.noarch.rpm SHA-256: 4f507c4fee073d3c6a5d1e9f3594a46e4597809808e627278c925db1d7c872a2 podman-plugins-5.8.2-1.el9_8.x86_64.rpm SHA-256: 2e5d6a3431990a29939dcd4b2513955a6cc74b9e00506c820ed2f61f18a6409c podman-plugins-debuginfo-5.8.2-1.el9_8.x86_64.rpm SHA-256: 4e56d2d9cc9691ea7e15e1dca518bd64eb2557aef7a3eecd82b7f94eca470c99 podman-remote-5.8.2-1.el9_8.x86_64.rpm SHA-256: a6800a170678a1362c9445a65a3c973e82f3687cb3cfe7bd46168be426b8d835 podman-remote-debuginfo-5.8.2-1.el9_8.x86_64.rpm SHA-256: 2c4983fd6f8046c029ded06e00bd1c174ed822bf2f578557e71442b825bd147a podman-tests-5.8.2-1.el9_8.x86_64.rpm SHA-256: af6fc34946c4758fe803cc4d9ae67c91cdc726a15a014b17d2c75abaaa4a7475 podman-tests-debuginfo-5.8.2-1.el9_8.x86_64.rpm SHA-256: f0bef38e7fd6639733e040f1b51f341b7d2f0a2c06105fd934e6c91b88883e5c Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 SRPM podman-5.8.2-1.el9_8.src.rpm SHA-256: 04248396decb9142d5bc4558e199ce9dcecf671f1533d36bd369accf45fdb4fc x86_64 podman-5.8.2-1.el9_8.x86_64.rpm SHA-256: 3dd516752c9e6c56d7b377a5b75f4bfb9d5133bc884fb26f26d8bfa7fd649ce4 podman-debuginfo-5.8.2-1.el9_8.x86_64.rpm SHA-256: 06958a1a48581368d294ee026285c50799bfbd4fbe120739a72c6c20b069a3bc podman-debugsource-5.8.2-1.el9_8.x86_64.rpm SHA-256: bc20cb6e485072d0050e942c4420853edb138ab8704dd7aa2331501ccac8238f podman-docker-5.8.2-1.el9_8.noarch.rpm SHA-256: 4f507c4fee073d3c6a5d1e9f3594a46e4597809808e627278c925db1d7c872a2 podman-plugins-5.8.2-1.el9_8.x86_64.rpm SHA-256: 2e5d6a3431990a29939dcd4b2513955a6cc74b9e00506c820ed2f61f18a6409c podman-plugins-debuginfo-5.8.2-1.el9_8.x86_64.rpm SHA-256: 4e56d2d9cc9691ea7e15e1dca518bd64eb2557aef7a3eecd82b7f94eca470c99 podman-remote-5.8.2-1.el9_8.x86_64.rpm SHA-256: a6800a170678a1362c9445a65a3c973e82f3687cb3cfe7bd46168be426b8d835 podman-remote-debuginfo-5.8.2-1.el9_8.x86_64.rpm SHA-256: 2c4983fd6f8046c029ded06e00bd1c174ed822bf2f578557e71442b825bd147a podman-tests-5.8.2-1.el9_8.x86_64.rpm SHA-256: af6fc34946c4758fe803cc4d9ae67c91cdc726a15a014b17d2c75abaaa4a7475 podman-tests-debuginfo-5.8.2-1.el9_8.x86_64.rpm SHA-256: f0bef38e7fd6639733e040f1b51f341b7d2f0a2c06105fd934e6c91b88883e5c Red Hat Enterprise Linux for IBM z Systems 9 SRPM podman-5.8.2-1.el9_8.src.rpm SHA-256: 04248396decb9142d5bc4558e199ce9dcecf671f1533d36bd369accf45fdb4fc s390x podman-5.8.2-1.el9_8.s390x.rpm SHA-256: 6ef0e840e6022833cc2763d29cb9e812c32941428f211e0b4fa8ce30f92c54b5 podman-debuginfo-5.8.2-1.el9_8.s390x.rpm SHA-256: 384c1defcd918b6519c782627d71155485d95be7926d6cd009e85907b8ac7ae9 podman-debugsource-5.8.2-1.el9_8.s390x.rpm SHA-256: 9e6e41a3dcdffe3c3f5715f1b653a580ce0d76dd6073ec6a119e6db2237a9e3b podman-docker-5.8.2-1.el9_8.noarch.rpm SHA-256: 4f507c4fee073d3c6a5d1e9f3594a46e4597809808e627278c925db1d7c872a2 podman-plugins-5.8.2-1.el9_8.s390x.rpm SHA-256: 2ed5cff7a2e8200bba8eada02490c71468fb21c7aa57d138d5222d4e95d49f45 podman-plugins-debuginfo-5.8.2-1.el9_8.s390x.rpm SHA-256: addccaa76bae2c97e764807d22a9d8e38561f99d828ee08192020168f9086f7a podman-remote-5.8.2-1.el9_8.s390x.rpm SHA-256: 050e102b7b24f3f7b67d5ffa62ad1a14f63e7da96dc9fb68be3620bc8fb61d19 podman-remote-debuginfo-5.8.2-1.el9_8.s390x.rpm SHA-256: ae8e626e568e02e55a6a79f13d5d3b475a947e5208e202267f43a15a7cd58d1d podman-tests-5.8.2-1.el9_8.s390x.rpm SHA-256: c6eb2c4be8842c5f498e057e5ba117f6e6509d690dec01f46df37b6b00e7b46b podman-tests-debuginfo-5.8.2-1.el9_8.s390x.rpm SHA-256: 6ef567c5e0b9db450ae25984c7e209076d3fd99d41d6a02d398027a89d149d27 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 SRPM podman-5.8.2-1.el9_8.src.rpm SHA-256: 04248396decb9142d5bc4558e199ce9dcecf671f1533d36bd369accf45fdb4fc s390x podman-5.8.2-1.el9_8.s390x.rpm SHA-256: 6ef0e840e6022833cc2763d29cb9e812c32941428f211e0b4fa8ce30f92c54b5 podman-debuginfo-5.8.2-1.el9_8.s390x.rpm SHA-256: 384c1defcd918b6519c782627d71155485d95be7926d6cd009e85907b8ac7ae9 podman-debugsource-5.8.2-1.el9_8.s390x.rpm SHA-256: 9e6e41a3dcdffe3c3f5715f1b653a580ce0d76dd6073ec6a119e6db2237a9e3b podman-docker-5.8.2-1.el9_8.noarch.rpm SHA-256: 4f507c4fee073d3c6a5d1e9f3594a46e4597809808e627278c925db1d7c872a2 podman-plugins-5.8.2-1.el9_8.s390x.rpm SHA-256: 2ed5cff7a2e8200bba8eada02490c71468fb21c7aa57d138d5222d4e95d49f45 podman-plugins-debuginfo-5.8.2-1.el9_8.s390x.rpm SHA-256: addccaa76bae2c97e764807d22a9d8e38561f99d828ee08192020168f9086f7a podman-remote-5.8.2-1.el9_8.s390x.rpm SHA-256: 050e102b7b24f3f7b67d5ffa62ad1a14f63e7da96dc9fb68be3620bc8fb61d19 podman-remote-debuginfo-5.8.2-1.el9_8.s390x.rpm SHA-256: ae8e626e568e02e55a6a79f13d5d3b475a947e5208e202267f43a15a7cd58d1d podman-tests-5.8.2-1.el9_8.s390x.rpm SHA-256: c6eb2c4be8842c5f498e057e5ba117f6e6509d690dec01f46df37b6b00e7b46b podman-tests-debuginfo-5.8.2-1.el9_8.s390x.rpm SHA-256: 6ef567c5e0b9db450ae25984c7e209076d3fd99d41d6a02d398027a89d149d27 Red Hat Enterprise Linux for Power, little endian 9 SRPM podman-5.8.2-1.el9_8.src.rpm SHA-256: 04248396decb9142d5bc4558e199ce9dcecf671f1533d36bd369accf45fdb4fc ppc64le podman-5.8.2-1.el9_8.ppc64le.rpm SHA-256: 2aff5d9b2f705793198bc22c7a17f3b74f075b558ab15e075fe9ac1f74e3fd55 podman-debuginfo-5.8.2-1.el9_8.ppc64le.rpm SHA-256: ccc132a907adfcf5b13bebef6268d48c2fed0bde856f6ed4752618f20fc2e84f podman-debugsource-5.8.2-1.el9_8.ppc64le.rpm SHA-256: c845beb3bab27a3be9a2d1d197611336adffe091e1bfd2c91036f0224bde04c0 podman-docker-5.8.2-1.el9_8.noarch.rpm SHA-256: 4f507c4fee073d3c6a5d1e9f3594a46e4597809808e627278c925db1d7c872a2 podman-plugins-5.8.2-1.el9_8.ppc64le.rpm SHA-256: 17e2eae13d88f7e701735eb3a7364078898f8488774cf7535abf0639642ff27c podman-plugins-debuginfo-5.8.2-1.el9_8.ppc64le.rpm SHA-256: c5e1b4df48c432342e16d174db550d5336f88b0c2f24141136ecb1952aa2bc26 podman-remote-5.8.2-1.el9_8.ppc64le.rpm SHA-256: 11e2b4afd4f1ab995e92ef227a76d81af138fcf0f9f376d5dab767e15a0a1236 podman-remote-debuginfo-5.8.2-1.el9_8.ppc64le.rpm SHA-256: 0d7618524b2c77390f6d10474a7ffa808766f07e5e707a1d4ed0c4a081e6440e podman-tests-5.8.2-1.el9_8.ppc64le.rpm SHA-256: c1c7fe54cd3baae35e1a7b2a30ccdcbb3cd5c2acf7471de4a517e22486c03d18 podman-tests-debuginfo-5.8.2-1.el9_8.ppc64le.rpm SHA-256: c1e09e282a7729eb21bb1f4296b082b4b18b5ffc268fc7fd598bfe756f320e24 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 SRPM podman-5.8.2-1.el9_8.src.rpm SHA-256: 04248396decb9142d5bc4558e199ce9dcecf671f1533d36bd369accf45fdb4fc ppc64le podman-5.8.2-1.el9_8.ppc64le.rpm SHA-256: 2aff5d9b2f705793198bc22c7a17f3b74f075b558ab15e075fe9ac1f74e3fd55 podman-debuginfo-5.8.2-1.el9_8.ppc64le.rpm SHA-256: ccc132a907adfcf5b13bebef6268d48c2fed0bde856f6ed4752618