A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_70640 advisory.

    * buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

    * buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

    * buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

    * buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_70641 advisory.

    * skopeo: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

    * skopeo: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

    * skopeo: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

    * skopeo: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command,
    they can create files on the host machine with the privileges of the user running Podman. (CVE-2025-11395)

  - A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout
    header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary
    file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
    (CVE-2026-79699)

  - A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a
    crafted tar archive containing malicious symlinks can escape the target extraction directory and create
    files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
    (CVE-2026-79705)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70640 advisory.

    - rebuild for CVE-2026-56853 CVE-2026-56858 CVE-2026-33818 CVE-2026-56860 CVE-2026-56862
    - Ensures golang.org/x/crypto v0.53.0 for CVE-2026-46597 fix

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1915:08 advisory.

    * buildah: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)
      * buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
      * buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
      * buildah: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
      * buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1913:05 advisory.

    * skopeo: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
      * skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
      * skopeo: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
      * skopeo: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
      * skopeo: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70641 advisory.

    * skopeo: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

    * skopeo: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

    * skopeo: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

    * skopeo: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70640 advisory.

    * buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

    * buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

    * buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

    * buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 050e54b4-b81e-11f1-b540-589cfc10a551 advisory.

    The Podman developers report:
    This release addresses (CVE-2025-11395), where importing images               containing crafted layer tarballs with the podman load command, or               importing volumes containing crafted symlinks with podman volume               import, allows overwriting files on the host.
    This release also addresses CVE-2026-79699 and CVE-2026-79705,               though we do not believe these CVEs are exploitable through the               Podman command line.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70641 advisory.

    - rebuild for CVE-2026-56853 CVE-2026-56858 CVE-2026-33818 CVE-2026-56860 CVE-2026-56862

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70641 advisory.

    * skopeo: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
      * skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
      * skopeo: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
      * skopeo: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)
      * skopeo: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70640 advisory.

    * buildah: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service     (CVE-2026-56853)
      * buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
      * buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
      * buildah: golang net/url: Denial of Service from quadratic complexity in path resolution     (CVE-2026-56860)
      * buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70640 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

    * buildah: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * buildah: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

    * buildah: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

    * buildah: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70641 advisory.

    Command line utility to inspect images and repositories directly on Docker registries without the need to     pull them.

    Security Fix(es):

    * skopeo: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

    * skopeo: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

    * skopeo: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

    * skopeo: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

    * skopeo: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command,     they can create files on the host machine with the privileges of the user running Podman. (CVE-2025-11395)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
356527	Rocky Linux 9 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2026_70640)	Nessus	Rocky Linux Local Security Checks	Local	medium
354244	Rocky Linux 9 [CIQ] Security Update: skopeo / skopeo-debuginfo / skopeo-debugsource / skopeo-tests Multiple Vulnerabilities (crlsa-2026_70641)	Nessus	Rocky Linux Local Security Checks	Local	medium
448495	Alpine: multiple podman packages: security update to 5.8.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
448495	Alpine: multiple podman packages: security update to 5.8.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
350188	Oracle Linux 9 : buildah (ELSA-2026-70640)	Nessus	Oracle Linux Local Security Checks	Local	medium
350184	MiracleLinux 9 : buildah-1.43.3-2.el9_8 (AXSA:2026-1915:08)	Nessus	Miracle Linux Local Security Checks	Local	medium
350097	MiracleLinux 9 : skopeo-1.22.2-8.el9_8 (AXSA:2026-1913:05)	Nessus	Miracle Linux Local Security Checks	Local	medium
349901	RockyLinux 9 : skopeo (RLSA-2026:70641)	Nessus	Rocky Linux Local Security Checks	Local	medium
349899	RockyLinux 9 : buildah (RLSA-2026:70640)	Nessus	Rocky Linux Local Security Checks	Local	medium
349791	FreeBSD : podman -- vulnerabilities (050e54b4-b81e-11f1-b540-589cfc10a551)	Nessus	FreeBSD Local Security Checks	Local	medium
349766	Oracle Linux 9 : skopeo (ELSA-2026-70641)	Nessus	Oracle Linux Local Security Checks	Local	medium
349757	AlmaLinux 9 : skopeo (ALSA-2026:70641)	Nessus	Alma Linux Local Security Checks	Local	medium
349754	AlmaLinux 9 : buildah (ALSA-2026:70640)	Nessus	Alma Linux Local Security Checks	Local	medium
349626	RHEL 9 : buildah (RHSA-2026:70640)	Nessus	Red Hat Local Security Checks	Local	medium
349625	RHEL 9 : skopeo (RHSA-2026:70641)	Nessus	Red Hat Local Security Checks	Local	medium
345980	Linux Distros Unpatched Vulnerability : CVE-2025-11395	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-11395

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium