criu-libs (AlmaLinux:8) — known CVEs & security advisories
Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:8 package criu-libs, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.
CVEs (93)
CVE-2025-68121 — CVSS 10.0 (critical): During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake…
CVE-2023-24538 — CVSS 9.8 (critical): Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used…
CVE-2023-24540 — CVSS 9.8 (critical): Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the…
CVE-2025-22871 — CVSS 9.1 (critical): The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling…
CVE-2022-1227 — CVSS 8.8 (high): A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this…
CVE-2024-11218 — CVSS 8.6 (high): A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition…
CVE-2024-21626 — CVSS 8.6 (high): runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an…
CVE-2024-1753 — CVSS 8.6 (high): A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem…
CVE-2024-3727 — CVSS 8.3 (high): A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry…
CVE-2025-6032 — CVSS 8.3 (high): A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI…
CVE-2025-9566 — CVSS 8.1 (high): There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a…
CVE-2024-9675 — CVSS 7.8 (high): A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache…
CVE-2025-31133 — CVSS 7.8 (high): runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through…
CVE-2022-30633 — CVSS 7.5 (high): Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack…
CVE-2022-30635 — CVSS 7.5 (high): Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack…
CVE-2022-32189 — CVSS 7.5 (high): A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially…
CVE-2022-41715 — CVSS 7.5 (high): Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed…
CVE-2022-30630 — CVSS 7.5 (high): Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a…
CVE-2021-33198 — CVSS 7.5 (high): In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText…
CVE-2022-1708 — CVSS 7.5 (high): A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The…
CVE-2022-21698 — CVSS 7.5 (high): client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling…
CVE-2022-27191 — CVSS 7.5 (high): The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain…
CVE-2022-27649 — CVSS 7.5 (high): A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby…
CVE-2022-27650 — CVSS 7.5 (high): A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby…
CVE-2022-27664 — CVSS 7.5 (high): In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang…
CVE-2022-28131 — CVSS 7.5 (high): Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack…
CVE-2022-2879 — CVSS 7.5 (high): Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded…
CVE-2022-2880 — CVSS 7.5 (high): Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by…
CVE-2022-30631 — CVSS 7.5 (high): Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack…
CVE-2022-30632 — CVSS 7.5 (high): Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion…
CVE-2022-41723 — CVSS 7.5 (high): A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service…
CVE-2022-41724 — CVSS 7.5 (high): Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers…
CVE-2022-41725 — CVSS 7.5 (high): A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with…
CVE-2023-24534 — CVSS 7.5 (high): HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of…
CVE-2023-24536 — CVSS 7.5 (high): Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This…
CVE-2023-24537 — CVSS 7.5 (high): Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite…
CVE-2023-39322 — CVSS 7.5 (high): QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC…
CVE-2023-45287 — CVSS 7.5 (high): Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent…
CVE-2024-1394 — CVSS 7.5 (high): A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using…
CVE-2024-24784 — CVSS 7.5 (high): The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment…
CVE-2024-24786 — CVSS 7.5 (high): The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when…
CVE-2024-24791 — CVSS 7.5 (high): The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a…
CVE-2024-34156 — CVSS 7.5 (high): Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up…
CVE-2024-34158 — CVSS 7.5 (high): Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
CVE-2024-37298 — CVSS 7.5 (high): gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a…
CVE-2025-22869 — CVSS 7.5 (high): SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key…
CVE-2025-47913 — CVSS 7.5 (high): SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
CVE-2025-52565 — CVSS 7.5 (high): runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1…
CVE-2025-52881 — CVSS 7.5 (high): runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an…
CVE-2025-61726 — CVSS 7.5 (high): The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs…
CVE-2025-61729 — CVSS 7.5 (high): Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out…
CVE-2025-65637 — CVSS 7.5 (high): A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than…
CVE-2023-24539 — CVSS 7.3 (high): Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions…
CVE-2023-29400 — CVSS 7.3 (high): Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected…
CVE-2022-2990 — CVSS 7.1 (high): An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or…
CVE-2022-2989 — CVSS 7.1 (high): An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or…
CVE-2023-27561 — CVSS 7.0 (high): runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit…
CVE-2019-19921 — CVSS 7.0 (high): runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To…
CVE-2022-27651 — CVSS 6.8 (medium): A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker…
CVE-2023-0778 — CVSS 6.8 (medium): A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume…
CVE-2025-61728 — CVSS 6.5 (medium): archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead…
CVE-2023-45290 — CVSS 6.5 (medium): When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue…
CVE-2023-29406 — CVSS 6.5 (medium): The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers…
CVE-2024-9676 — CVSS 6.5 (medium): A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause…
CVE-2021-4024 — CVSS 6.5 (medium): A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process)…
CVE-2022-32148 — CVSS 6.5 (medium): Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.Serve…
CVE-2022-1705 — CVSS 6.5 (medium): Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request…
CVE-2021-20291 — CVSS 6.5 (medium): A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each…
CVE-2023-3978 — CVSS 6.1 (medium): Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to…
CVE-2023-28642 — CVSS 6.1 (medium): runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when…
CVE-2023-39318 — CVSS 6.1 (medium): The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts…
CVE-2023-39319 — CVSS 6.1 (medium): The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals…
CVE-2024-6104 — CVSS 6.0 (medium): go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing…
CVE-2022-29162 — CVSS 5.9 (medium): runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to…
CVE-2024-24788 — CVSS 5.9 (medium): A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
CVE-2024-24783 — CVSS 5.9 (medium): Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic…
CVE-2024-24789 — CVSS 5.5 (medium): The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This…
CVE-2021-3602 — CVSS 5.5 (medium): An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds…
CVE-2022-1962 — CVSS 5.5 (medium): Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack…
CVE-2024-24785 — CVSS 5.4 (medium): If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior…
CVE-2024-9341 — CVSS 5.4 (medium): A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper…
CVE-2023-29409 — CVSS 5.3 (medium): Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the…
CVE-2023-25173 — CVSS 5.3 (medium): containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary…
CVE-2023-39326 — CVSS 5.3 (medium): A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from…
CVE-2022-41717 — CVSS 5.3 (medium): An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP…
CVE-2023-25809 — CVSS 5.0 (medium): runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless…
CVE-2024-28176 — CVSS 4.9 (medium): jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS)…
CVE-2024-9407 — CVSS 4.7 (medium): A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the…
CVE-2024-34155 — CVSS 4.3 (medium): Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
CVE-2024-28180 — CVSS 4.3 (medium): Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a…
CVE-2022-30629 — CVSS 3.1 (low): Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe…