podman (AlmaLinux:10) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:10 package podman, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (9)

• CVE-2025-9566 — CVSS 8.1 (high): There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a…
• CVE-2026-34986 — CVSS 7.5 (high): Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web…
• CVE-2026-32283 — CVSS 7.5 (high): If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock…
• CVE-2025-22869 — CVSS 7.5 (high): SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key…
• CVE-2026-25679 — CVSS 7.5 (high): url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
• CVE-2026-32280 — CVSS 7.5 (high): During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed…
• CVE-2026-32281 — CVSS 7.5 (high): Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of…
• CVE-2025-47907 — CVSS 7.0 (high): Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned…
• CVE-2025-27144: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web…