Red Hat Product Errata RHSA-2026:38493 - Security Advisory Issued: 2026-07-13 Updated: 2026-07-13 RHSA-2026:38493 - Security Advisory Overview Updated Packages Synopsis Important: buildah security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for buildah is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2498152 - CVE-2026-39822 os: golang: Go os.Root: Symlink following vulnerability allows directory traversal CVEs CVE-2026-39822 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM buildah-1.43.1-4.el9_8.src.rpm SHA-256: 77e00de17ff4ac562c1d2e5a6fd4869c92c4c9fc34daafbc9e9c44e54cdd1f49 x86_64 buildah-1.43.1-4.el9_8.x86_64.rpm SHA-256: ffe02fe25e0532eb3fdb188907fa83cc4dd7c4f3315c11a298fea85ccccf8239 buildah-debuginfo-1.43.1-4.el9_8.x86_64.rpm SHA-256: 96199af0e3c486bf115d0da324d538766eb5c0bf98d1ed9d2be02c80e2286de2 buildah-debugsource-1.43.1-4.el9_8.x86_64.rpm SHA-256: 235f37768430787d1de04865f423d97a63d4633aa5509850a2a0ac29b9b144bc buildah-tests-1.43.1-4.el9_8.x86_64.rpm SHA-256: d0f38b7d20e937c89dde407304933d923567fcef1679994d961243d61f8e4ad0 buildah-tests-debuginfo-1.43.1-4.el9_8.x86_64.rpm SHA-256: b59110d78d14928ca5e65be7e807922f6b98a9fbcd34d77af88c2267c0aafced Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 SRPM buildah-1.43.1-4.el9_8.src.rpm SHA-256: 77e00de17ff4ac562c1d2e5a6fd4869c92c4c9fc34daafbc9e9c44e54cdd1f49 x86_64 buildah-1.43.1-4.el9_8.x86_64.rpm SHA-256: ffe02fe25e0532eb3fdb188907fa83cc4dd7c4f3315c11a298fea85ccccf8239 buildah-debuginfo-1.43.1-4.el9_8.x86_64.rpm SHA-256: 96199af0e3c486bf115d0da324d538766eb5c0bf98d1ed9d2be02c80e2286de2 buildah-debugsource-1.43.1-4.el9_8.x86_64.rpm SHA-256: 235f37768430787d1de04865f423d97a63d4633aa5509850a2a0ac29b9b144bc buildah-tests-1.43.1-4.el9_8.x86_64.rpm SHA-256: d0f38b7d20e937c89dde407304933d923567fcef1679994d961243d61f8e4ad0 buildah-tests-debuginfo-1.43.1-4.el9_8.x86_64.rpm SHA-256: b59110d78d14928ca5e65be7e807922f6b98a9fbcd34d77af88c2267c0aafced Red Hat Enterprise Linux for IBM z Systems 9 SRPM buildah-1.43.1-4.el9_8.src.rpm SHA-256: 77e00de17ff4ac562c1d2e5a6fd4869c92c4c9fc34daafbc9e9c44e54cdd1f49 s390x buildah-1.43.1-4.el9_8.s390x.rpm SHA-256: 7c19539b6bd783a25551d4dfeb4078442e539daf236e7aef70c020db99c7ee51 buildah-debuginfo-1.43.1-4.el9_8.s390x.rpm SHA-256: 737961453fba45c9e7e7186b0c203db83f583944a103523a965ab0f804358af8 buildah-debugsource-1.43.1-4.el9_8.s390x.rpm SHA-256: 5735246de626d6895ae9d7273f7c9cfc6fb1b2f68d71f8b65fe0056f8412b6d3 buildah-tests-1.43.1-4.el9_8.s390x.rpm SHA-256: a621a93c14b85cae80d2513ef02b4b13b586e5e885d18ce2ab9f9943bcbc4a31 buildah-tests-debuginfo-1.43.1-4.el9_8.s390x.rpm SHA-256: aa9c35744e36babc03875d971d2dac430ca80e4e87c1b0b63708d6f7b5e1a299 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 SRPM buildah-1.43.1-4.el9_8.src.rpm SHA-256: 77e00de17ff4ac562c1d2e5a6fd4869c92c4c9fc34daafbc9e9c44e54cdd1f49 s390x buildah-1.43.1-4.el9_8.s390x.rpm SHA-256: 7c19539b6bd783a25551d4dfeb4078442e539daf236e7aef70c020db99c7ee51 buildah-debuginfo-1.43.1-4.el9_8.s390x.rpm SHA-256: 737961453fba45c9e7e7186b0c203db83f583944a103523a965ab0f804358af8 buildah-debugsource-1.43.1-4.el9_8.s390x.rpm SHA-256: 5735246de626d6895ae9d7273f7c9cfc6fb1b2f68d71f8b65fe0056f8412b6d3 buildah-tests-1.43.1-4.el9_8.s390x.rpm SHA-256: a621a93c14b85cae80d2513ef02b4b13b586e5e885d18ce2ab9f9943bcbc4a31 buildah-tests-debuginfo-1.43.1-4.el9_8.s390x.rpm SHA-256: aa9c35744e36babc03875d971d2dac430ca80e4e87c1b0b63708d6f7b5e1a299 Red Hat Enterprise Linux for Power, little endian 9 SRPM buildah-1.43.1-4.el9_8.src.rpm SHA-256: 77e00de17ff4ac562c1d2e5a6fd4869c92c4c9fc34daafbc9e9c44e54cdd1f49 ppc64le buildah-1.43.1-4.el9_8.ppc64le.rpm SHA-256: da9323446fbeacdd8fafe7285695768b38ad842c39949a8cc96bc587130490bc buildah-debuginfo-1.43.1-4.el9_8.ppc64le.rpm SHA-256: 4382205fad83db90d726465e280d2e6cd3c90000837e9d36c15dd5a4a1d836b9 buildah-debugsource-1.43.1-4.el9_8.ppc64le.rpm SHA-256: c35832df10c72e18a4c8b2f852a328ee8ca2726aae5b1b77f87bf9f1bdd620c4 buildah-tests-1.43.1-4.el9_8.ppc64le.rpm SHA-256: 363723392b4fcd71eff185c405498fdda5f6cd9c36d7a52df03214d3533e47e1 buildah-tests-debuginfo-1.43.1-4.el9_8.ppc64le.rpm SHA-256: 2a54832e472c5812ac7def18f76d34eb2e0f953190099bcf122a0ded5937122c Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 SRPM buildah-1.43.1-4.el9_8.src.rpm SHA-256: 77e00de17ff4ac562c1d2e5a6fd4869c92c4c9fc34daafbc9e9c44e54cdd1f49 ppc64le buildah-1.43.1-4.el9_8.ppc64le.rpm SHA-256: da9323446fbeacdd8fafe7285695768b38ad842c39949a8cc96bc587130490bc buildah-debuginfo-1.43.1-4.el9_8.ppc64le.rpm SHA-256: 4382205fad83db90d726465e280d2e6cd3c90000837e9d36c15dd5a4a1d836b9 buildah-debugsource-1.43.1-4.el9_8.ppc64le.rpm SHA-256: c35832df10c72e18a4c8b2f852a328ee8ca2726aae5b1b77f87bf9f1bdd620c4 buildah-tests-1.43.1-4.el9_8.ppc64le.rpm SHA-256: 363723392b4fcd71eff185c405498fdda5f6cd9c36d7a52df03214d3533e47e1 buildah-tests-debuginfo-1.43.1-4.el9_8.ppc64le.rpm SHA-256: 2a54832e472c5812ac7def18f76d34eb2e0f953190099bcf122a0ded5937122c Red Hat Enterprise Linux for ARM 64 9 SRPM buildah-1.43.1-4.el9_8.src.rpm SHA-256: 77e00de17ff4ac562c1d2e5a6fd4869c92c4c9fc34daafbc9e9c44e54cdd1f49 aarch64 buildah-1.43.1-4.el9_8.aarch64.rpm SHA-256: ebc024a71d546096566a70686dae9beba23f3ecc84c2743610d8b81d82445421 buildah-debuginfo-1.43.1-4.el9_8.aarch64.rpm SHA-256: 5145a39cb966968431423db84e9a1cc841f2eca8e2d9c8a2eca091ebb0a490db buildah-debugsource-1.43.1-4.el9_8.aarch64.rpm SHA-256: dadd9298215c52448214be7a921fb2a857a4a47b31b59f3db9b9faee24e37e5d buildah-tests-1.43.1-4.el9_8.aarch64.rpm SHA-256: aa3d847257b5f61441c5467b691b47bdf2d116d1d01b80f784b6c1ed17043b08 buildah-tests-debuginfo-1.43.1-4.el9_8.aarch64.rpm SHA-256: b5ba6813fa1a2f5cea4be3d32484ac898b5acd8abd3fa48f51168f0952c7008d Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 SRPM buildah-1.43.1-4.el9_8.src.rpm SHA-256: 77e00de17ff4ac562c1d2e5a6fd4869c92c4c9fc34daafbc9e9c44e54cdd1f49 aarch64 buildah-1.43.1-4.el9_8.aarch64.rpm SHA-256: ebc024a71d546096566a70686dae9beba23f3ecc84c2743610d8b81d82445421 buildah-debuginfo-1.43.1-4.el9_8.aarch64.rpm SHA-256: 5145a39cb966968431423db84e9a1cc841f2eca8e2d9c8a2eca091ebb0a490db buildah-debugsource-1.43.1-4.el9_8.aarch64.rpm SHA-256: dadd9298215c52448214be7a921fb2a857a4a47b31b59f3db9b9faee24e37e5d buildah-tests-1.43.1-4.el9_8.aarch64.rpm SHA-256: aa3d847257b5f61441c5467b691b47bdf2d116d1d01b80f784b6c1ed17043b08 buildah-tests-debuginfo-1.43.1-4.el9_8.aarch64.rpm SHA-256: b5ba6813fa1a2f5cea4be3d32484ac898b5acd8abd3fa48f51168f0952c7008d Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 SRPM buildah-1.43.1-4.el9_8.src.rpm SHA-256: 77e00de17ff4ac562c1d2e5a6fd4869c92c4c9fc34daafbc9e9c44e54cdd1f49 ppc64le buildah-1.43.1-4.el9_8.ppc64le.rpm SHA-256: da9323446fbeacdd8fafe7285695768b38ad842c39949a8cc96bc587130490bc buildah-debuginfo-1.43.1-4.el9_8.ppc64le.rpm SHA-256: 4382205fad83db90d726465e280d2e6cd3c90000837e9d36c15dd5a4a1d836b9 buildah-debugsource-1.43.1-4.el9_8.ppc64le.rpm SHA-256: c35832df10c72e18a4c8b2f852a328ee8ca2726aae5b1b77f87bf9f1bdd620c4 buildah-tests-1.43.1-4.el9_8.ppc64le.rpm SHA-256: 363723392b4fcd71eff185c405498fdda5f6cd9c36d7a52df03214d3533e47e1 buildah-tests-debuginfo-1.43.1-4.el9_8.ppc64le.rpm SHA-256: 2a54832e472c5812ac7def18f76d34eb2e0f953190099bcf122a0ded5937122c Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 SRPM buildah-1.43.1-4.el9_8.src.rpm SHA-256: 77e00de17ff4a