github.com/containers/buildah
A tool that facilitates building OCI images.
View on Github
Activity
- Latest release
- 1mo ago
- Total releases
- 63
- Cadence
- ~20 days
- Last 12 months
- 18
Reach
- Stars
- 9.0k
Details
- First release
- Apr 04, 2018
| Version | Released | |
|---|---|---|
v1.45.0
minor
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.45.0
minor
Dependencies (41)
+ 33 more |
|
v1.44.1
patch
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.44.1
patch
Dependencies (40)
+ 32 more |
|
v1.43.2
patch
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.43.2
patch
Dependencies (37)
+ 29 more |
|
v1.44.0
minor
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.44.0
minor
Dependencies (39)
+ 31 more |
|
v1.29.8
patch
4 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.29.8
patch
Dependencies (35)
+ 27 more |
|
v1.26.11
patch
5 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.26.11
patch
Dependencies (35)
+ 27 more |
|
v1.41.9
patch
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.41.9
patch
Dependencies (37)
+ 29 more |
|
v1.43.1
minor
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.43.1
minor
Dependencies (37)
+ 29 more |
|
v1.43.0
minor
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.43.0
minor
Dependencies (37)
+ 29 more |
|
v1.41.8
patch
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.41.8
patch
Dependencies (37)
+ 29 more |
|
v1.41.7
patch
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.41.7
patch
Dependencies (37)
+ 29 more |
|
v1.27.7
minor
4 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.27.7
minor
Dependencies (34)
+ 26 more |
|
v1.42.2
minor
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.42.2
minor
Dependencies (37)
+ 29 more |
|
v1.39.6
patch
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.39.6
patch
Dependencies (37)
+ 29 more |
|
v1.39.5
minor
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.39.5
minor
Dependencies (37)
+ 29 more |
|
v1.41.6
patch
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.41.6
patch
Dependencies (37)
+ 29 more |
|
v1.42.1
patch
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.42.1
patch
Dependencies (37)
+ 29 more |
|
v1.42.0
minor
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.42.0
minor
Dependencies (37)
+ 29 more |
|
v1.41.5
patch
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.41.5
patch
Dependencies (37)
+ 29 more |
|
v1.41.4
patch
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.41.4
patch
Dependencies (37)
+ 29 more |
|
v1.41.3
patch
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.41.3
patch
Dependencies (37)
+ 29 more |
|
v1.41.2
patch
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.41.2
patch
Dependencies (37)
+ 29 more |
|
v1.41.1
patch
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.41.1
patch
Dependencies (37)
+ 29 more |
|
v1.41.0
minor
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.41.0
minor
Dependencies (37)
+ 29 more |
|
v1.40.1
minor
1 CVE
CVE-2026-44517
GO-2026-5116
GHSA-49p4-px3h-rq49
Jul 27, 2026
Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation. Updated Jul 27, 2026 · Source: OSV.dev |
v1.40.1
minor
Dependencies (37)
+ 29 more |
|
v1.29.5
patch
4 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.29.5
patch
Dependencies (34)
+ 26 more |
|
v1.35.5
patch
2 CVEs
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.35.5
patch
Dependencies (37)
+ 29 more |
|
v1.35.4
minor
3 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.35.4
minor
Dependencies (37)
+ 29 more |
|
v1.26.7
patch
5 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.26.7
patch
Dependencies (35)
+ 27 more |
|
v1.24.7
minor
6 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.24.7
minor
Dependencies (35)
+ 27 more |
|
v1.32.3
patch
4 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.32.3
patch
Dependencies (36)
+ 28 more |
|
v1.34.2
patch
3 CVEs
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.34.2
patch
Dependencies (37)
+ 29 more |
|
v1.34.1
minor
3 CVEs
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.34.1
minor
Dependencies (37)
+ 29 more |
|
v1.32.1
minor
4 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.32.1
minor
Dependencies (36)
+ 28 more |
|
v1.29.0
minor
4 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.29.0
minor
Dependencies (34)
+ 26 more |
|
v1.23.5
patch
6 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.23.5
patch
Dependencies (34)
+ 26 more |
|
v1.26.2
patch
5 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.26.2
patch
Dependencies (35)
+ 27 more |
|
v1.26.0
minor
5 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.26.0
minor
Dependencies (35)
+ 27 more |
|
v1.23.3
patch
6 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.23.3
patch
Dependencies (34)
+ 26 more |
|
v1.22.4
patch
6 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.22.4
patch
Dependencies (32)
+ 24 more |
|
v1.23.1
patch
6 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.23.1
patch
Dependencies (34)
+ 26 more |
|
v1.23.0
minor
6 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.23.0
minor
Dependencies (34)
+ 26 more |
|
v1.22.3
minor
6 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.22.3
minor
Dependencies (32)
+ 24 more |
|
v1.21.4
patch
7 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2021-3602
GO-2022-0345
GHSA-7638-r9r3-rmjj
Jul 15, 2022
Environment variable leakage in github.com/containers/buildah The RunUsingChroot function unintentionally propagates environment variables from the current process to the child process. Fixed in
1.22.0
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.21.4
patch
Dependencies (32)
+ 24 more |
|
v1.21.3
minor
7 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2021-3602
GO-2022-0345
GHSA-7638-r9r3-rmjj
Jul 15, 2022
Environment variable leakage in github.com/containers/buildah The RunUsingChroot function unintentionally propagates environment variables from the current process to the child process. Fixed in
1.22.0
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.21.3
minor
Dependencies (32)
+ 24 more |
|
v1.19.2
minor
7 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2021-3602
GO-2022-0345
GHSA-7638-r9r3-rmjj
Jul 15, 2022
Environment variable leakage in github.com/containers/buildah The RunUsingChroot function unintentionally propagates environment variables from the current process to the child process. Fixed in
1.22.0
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.19.2
minor
Dependencies (32)
+ 24 more |
|
v1.16.6
patch
7 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2021-3602
GO-2022-0345
GHSA-7638-r9r3-rmjj
Jul 15, 2022
Environment variable leakage in github.com/containers/buildah The RunUsingChroot function unintentionally propagates environment variables from the current process to the child process. Fixed in
1.22.0
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.16.6
patch
Dependencies (32)
+ 24 more |
|
v1.16.5
patch
7 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2021-3602
GO-2022-0345
GHSA-7638-r9r3-rmjj
Jul 15, 2022
Environment variable leakage in github.com/containers/buildah The RunUsingChroot function unintentionally propagates environment variables from the current process to the child process. Fixed in
1.22.0
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.16.5
patch
Dependencies (32)
+ 24 more |
|
v1.16.0
minor
7 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2021-3602
GO-2022-0345
GHSA-7638-r9r3-rmjj
Jul 15, 2022
Environment variable leakage in github.com/containers/buildah The RunUsingChroot function unintentionally propagates environment variables from the current process to the child process. Fixed in
1.22.0
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.16.0
minor
Dependencies (32)
+ 24 more |
|
v1.15.2
patch
7 CVEs
CVE-2024-11218
GO-2025-3414
GHSA-5vpc-35f4-r8w6
Jan 28, 2025
Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Buildah allows build breakout using malicious Containerfiles and concurrent builds in github.com/containers/buildah Fixed in
1.33.12
1.35.5
1.37.6
1.38.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9675
GO-2024-3186
GHSA-586p-749j-fhwp
Oct 11, 2024
Buildah allows arbitrary directory mount in github.com/containers/buildah Buildah allows arbitrary directory mount in github.com/containers/buildah Fixed in
1.37.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-9407
GO-2024-3169
GHSA-fhqq-8f65-5xfc
Oct 09, 2024
Improper Input Validation in Buildah and Podman in github.com/containers/buildah Improper Input Validation in Buildah and Podman in github.com/containers/buildah Fixed in
1.37.4
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2024-1753
GO-2024-2658
GHSA-874v-pj72-92f3
GHSA-pmf3-c36m-g5cf
Mar 22, 2024
Container escape at build time in github.com/containers/buildah A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem. Fixed in
1.35.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-2990
GO-2022-1008
GHSA-fjm8-m7m6-2fjp
Sep 21, 2022
Unauthorized file access in github.com/containers/buildah SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other users except for ones in group g1. A program with the set-group-ID (SGID) bit set assumes the primary group of the program's group when it executes. A user with the primary group g1 who executes an SGID program owned by group g2 should not be able to access the file described above. While the program executes with the primary group g2, the group g1 should remain in its supplementary groups, blocking access to the file. Buildah does not correctly add g1 to the supplementary groups in this scenario, permitting unauthorized access. Fixed in
1.27.1
References Updated Feb 04, 2026 · Source: OSV.dev
CVE-2021-3602
GO-2022-0345
GHSA-7638-r9r3-rmjj
Jul 15, 2022
Environment variable leakage in github.com/containers/buildah The RunUsingChroot function unintentionally propagates environment variables from the current process to the child process. Fixed in
1.22.0
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2022-27651
GO-2022-0417
GHSA-c3g4-w6cv-6v7h
Jul 01, 2022
Incorrect default permissions in github.com/containers/buildah Containers are created with non-empty inheritable Linux process capabilities, permitting programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug does not affect the container security sandbox, as the inheritable set never contains more capabilities than are included in the container's bounding set. Fixed in
1.25.0
References Updated Feb 04, 2026 · Source: OSV.dev |
v1.15.2
patch
Dependencies (33)
+ 25 more |