GoPackage

github.com/containers/podman/v4

18 known vulnerabilities (1 critical, 7 high, 7 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: v4.9.5 (May 30, 2024): affected by 13 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 18 · 1 critical, 7 high, 7 medium, 1 low

Releases: 52 since v4.0.0 (Feb 17, 2022)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-94603
Affects v4.4.0 to v4.9.5 (through the newest release)
CVE-2026-19730
Affects v4.0.0-rc2 to v4.9.5 (through the newest release)
CVE-2026-55686
Affects v4.0.0-rc2 to v4.9.5 (through the newest release)
CVE-2026-57231
Affects v4.0.0-rc2 to v4.9.5 (through the newest release)
CVE-2026-33414
Affects v4.8.0 to v4.9.5 (through the newest release)
CVE-2025-4953
Affects v4.0.0-rc2 to v4.9.5 (through the newest release)
CVE-2025-9566
Affects v4.0.0-rc2 to v4.9.5 (through the newest release)
CVE-2025-6032
Affects v4.8.0 to v4.9.5 (through the newest release)
CVE-2024-9407
Affects v4.0.0-rc2 to v4.9.5 (through the newest release)
CVE-2024-3056
Affects v4.0.0-rc2 to v4.9.5 (through the newest release)
CVE-2024-1753
Affects v4.0.0-rc2 to v4.9.3 (v4.9.4 is outside it)
CVE-2023-0778
Affects v4.0.0-rc2 to v4.4.1 (v4.4.2 is outside it)

Show all 18 advisoriesShow fewer advisories

CVE-2022-4123
Affects v4.1.0-rc1 to v4.9.5 (through the newest release)
CVE-2022-4122
Affects v4.0.0-rc2 to v4.5.0-rc2 (v4.5.0 is outside it)
CVE-2022-2989
Affects v4.0.0-rc2 to v4.2.0-rc3 (v4.2.0 is outside it)
CVE-2022-27649
Affects v4.0.0-rc2 to v4.0.2 (v4.0.3 is outside it)
CVE-2019-18466
Affects v4.0.0-rc2 to v4.9.5 (through the newest release)
CVE-2018-10856
Affects v4.0.0-rc2 to v4.9.5 (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 18

CVE-2026-94603Critical 10.0
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
Affected: from 4.4.0, fixed in 5.8.8; from 4.4.0.
No fix released. The latest release, v4.9.5, is still affected.
CVE-2026-19730Medium 4.2
Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives
Affected: all versions.
No fix released. The latest release, v4.9.5, is still affected.
CVE-2026-55686Medium 5.3
Podman: WORKDIR symlink traversal vulnerability
Affected: through 4.9.5.
No fix released. The latest release, v4.9.5, is still affected.
CVE-2026-57231High 7.5
Podman: Malformed Image can trick podman run into leaking host environment variables into the container
Affected: through 4.9.5; all versions.
No fix released. The latest release, v4.9.5, is still affected.
CVE-2026-33414Medium 4.0
PowerShell Command Injection in Podman HyperV Machine
Affected: from 4.8.0, through 4.9.5; from 4.8.0.
No fix released. The latest release, v4.9.5, is still affected.
CVE-2025-4953High 7.4
Podman: build context bind mount
Affected: all versions.
No fix released. The latest release, v4.9.5, is still affected.
CVE-2025-9566High 8.1
Podman: podman kube play command may overwrite host files
Affected: through 4.9.5; all versions.
No fix released. The latest release, v4.9.5, is still affected.
CVE-2025-6032High 8.3
Podman: podman missing tls verification
Affected: from 4.8.0, through 4.9.5; from 4.8.0.
No fix released. The latest release, v4.9.5, is still affected.
CVE-2024-9407Medium 4.7
Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction
Affected: fixed in 5.2.4; all versions.
No fix released. The latest release, v4.9.5, is still affected.
CVE-2024-3056High 7.7
Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack
Affected: through 5.2.0; all versions.
No fix released. The latest release, v4.9.5, is still affected.
CVE-2024-1753High 8.6
Buildah: buildah: container escape via improper bind mount validation
Affected: fixed in 4.9.4.
Fixed in v4.9.4 (released Mar 25, 2024, 7 days after disclosure).
The latest release, v4.9.5, is not affected.
CVE-2023-0778Medium 6.8
A Time-of-check Time-of-use (TOCTOU) flaw was found in podman.
Affected: fixed in 4.4.2.
Fixed in v4.4.2 (released Feb 23, 2023, 32 days before disclosure).
The latest release, v4.9.5, is not affected.
CVE-2022-4123Low 3.3
A flaw was found in Buildah.
Affected: from 4.1.0-rc1; from 4.1.0-rc1, through 4.4.1.
No fix released. The latest release, v4.9.5, is still affected.
CVE-2022-4122Medium 5.3
A vulnerability was found in buildah.
Affected: fixed in 4.5.0.
Fixed in v4.5.0 (released Apr 14, 2023, 127 days after disclosure).
The latest release, v4.9.5, is not affected.
CVE-2022-2989High 7.1
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or…
Affected: fixed in 4.2.0.
Fixed in v4.2.0 (released Aug 10, 2022, 34 days before disclosure).
The latest release, v4.9.5, is not affected.

Show all 18 advisoriesShow fewer advisories

CVE-2022-27649Unrated
A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.
Affected: fixed in 4.0.3.
Fixed in v4.0.3 (released Apr 1, 2022, 3 days before disclosure).
The latest release, v4.9.5, is not affected.
CVE-2019-18466Unrated
An issue was discovered in Podman in libpod before 1.6.0.
Affected: all versions; fixed in 1.6.0.
No fix released. The latest release, v4.9.5, is still affected.
CVE-2018-10856Medium 5.3
It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user.
Affected: all versions.
No fix released. The latest release, v4.9.5, is still affected.