GHSA-49p4-px3h-rq49Published
Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-44517 · Microsoft / collected KEV context
cve-program · CVE-2026-44517
- https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49
- https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c
- https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944
- https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2
- https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0
euvd · EUVD-2026-64141
- https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49
- https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c
- https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944
- https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2
- https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0
nvd · CVE-2026-44517
- https://github.com/podman-container-tools/buildah/commit/54459cf8a0feb4b1da766e4a6360451834e1846c
- https://github.com/podman-container-tools/buildah/commit/fc2003bb2efeb3ed7d5c7e1e88d04e78f370a944
- https://github.com/podman-container-tools/buildah/releases/tag/v1.43.2
- https://github.com/podman-container-tools/buildah/releases/tag/v1.44.0
- https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49
osv · GHSA-49p4-px3h-rq49
- https://github.com/containers/buildah/security/advisories/GHSA-49p4-px3h-rq49
- https://github.com/podman-container-tools/buildah/security/advisories/GHSA-49p4-px3h-rq49
- https://github.com/podman-container-tools/buildah
osv · GO-2026-5116
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.