Back Linuxsecurity

Fedora 43 Podman CVE-2026

Linuxsecurity •LinuxSecurity Advisories • April 17, 2026

podman (Pod Manager) is a fully featured container engine that is a simple daemonless tool. podman provides a Docker-CLI comparable command line that eases the transition from other container engines and allows the management of pods, containers and images. Simply put: alias docker=podman. Most podman commands can be run as a regular user, without requiring additional privileges. podman uses Buildah(1) internally to create container images. Both tools image (not container) storage, hence each can use or manipulate images (but not containers) created by the other. Update Information : Automatic update for skopeo-1.22.2-1.fc43, podman-5.8.2-1.fc43, buildah-1.43.1-1.fc43. Changelog for skopeo * Tue Apr 14 2026 Packit - 1:1.22.2-1 - Update to 1.22.2 upstream release * Fri Apr 10 2026 Lokesh Mandvekar - 1:1.22.1-2 - TMT: fix ref in plan * Thu Apr 09 2026 Packit - 1:1.22.1-1 - Update to 1.22.1 upstream release Changelog for podman * Tue Apr 14 2026 Packit - 5:5.8.2-1 - Update to 5.8.2 upstream release Changelog for buildah * Wed Apr 08 2026 Packit - 2:1.43.1-1 - Update to 1.43.1 upstream release Security fix for CVE-2026-34986

podman (Pod Manager) is a fully featured container engine that is a simple

daemonless tool. podman provides a Docker-CLI comparable command line that

eases the transition from other container engines and allows the management of

pods, containers and images. Simply put: alias docker=podman.

Most podman commands can be run as a regular user, without requiring

additional privileges.

podman uses Buildah(1) internally to create container images.

Both tools image (not container) storage, hence each can use or

manipulate images (but not containers) created by the other.

Automatic update for skopeo-1.22.2-1.fc43, podman-5.8.2-1.fc43, buildah-1.43.1-1.fc43. Changelog for skopeo * Tue Apr 14 2026 Packit - 1:1.22.2-1 - Update to 1.22.2 upstream release * Fri Apr 10 2026 Lokesh Mandvekar - 1:1.22.1-2 - TMT: fix ref in plan * Thu Apr 09 2026 Packit - 1:1.22.1-1 - Update to 1.22.1 upstream release Changelog for podman * Tue Apr 14 2026 Packit - 5:5.8.2-1 - Update to 5.8.2 upstream release Changelog for buildah * Wed Apr 08 2026 Packit - 2:1.43.1-1 - Update to 1.43.1 upstream release Security fix for CVE-2026-34986

* Tue Apr 14 2026 Packit - 5:5.8.2-1 - Update to 5.8.2 upstream release

[ 1 ] Bug #2455675 - CVE-2026-34986 skopeo: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-75c2b7868a' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical DoS Vulnerabilities in Fedora 43 Podman, Buildah, and Skopeo On April 6, 2026, CVE-2026-34986 was published, revealing a critical denial of service vulnerability affecting Fedora 43's Podman, Buildah, and Skopeo tools. This vulnerability allows attackers to exploit crafted JSON Web Encryption (JWE) objects, potentially leading to service disruptions. Users of Fedora 43 are urged to update their systems to mitigate this risk. The affected packages include skopeo version 1.22.2, podman version 5.8.2, and buildah version 1.43.1, all of which received automatic updates. The updates were released on April 14, 2026, and users can apply them using the 'dnf' update program. The vulnerability poses a significant threat to systems relying on these container management tools. Security teams should prioritize applying the updates to prevent potential exploitation. 4 sources 73

Extracted Entities

Fedora 43 Podman CVE-2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (2)