CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

sysutils/podman 5.8.9_2

Fixed in main, not merged to 2026Q4: podman -- vulnerabilities, podman -- vulnerabilities

Manage Pods, Containers and Container Images

Maintainer
dfr@FreeBSD.org
Packages
latest: 5.8.9_2
Upstream
Higher version available: 6.1.4
Last update
to 5.8.9_2 · d81b7ba3c3
Quarterly
2026Q4: 5.8.6_4 2 VuXML · last MFH 60647eff54
WWW
https://podman.io/
Links
cgit · VuXML

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 5.8.9_2.

Fixed (5)

Show 5 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (4) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
296293maintainer-feedback? sysutils/podman: CVE-2026-57231New2026-09-26
298420maintainer-feedback? sysutils/podman + freebsd linux: /proc is not mountedNew2026-09-12
282539maintainer-feedback? sysutils/podman: Setuid flag lost when creating container imageNew2026-07-05
291144maintainer-feedback? sysutils/podman: low incoming network performance in running containersNew2025-11-25

Commits (76)

Dag-Erling Smørgrav (des) · 5.8.9_2 MFH 2026Q4 ✓
various: Bump Go ports for Go 1.26.10 / 1.27.3
d81b7ba3c3
Sergey A. Osokin (osa) · 5.8.9_1
sysutils/*: update GH_ACCOUNTs and WWW

... for the podman-related staff.

PR:		299386
Approved by:	dfr (maintainer)

Sponsored by:	tipi.work
f19341266e
Sergey A. Osokin (osa) · 5.8.9
sysutils/podman: update: 5.8.8 -> 5.8.9

ChangeLog:	https://github.com/podman-container-tools/podman/compare/v5.8.8...v5.8.9

PR:		299332
Approved by:	dfr (maintainer)

Sponsored by:	tipi.work
6dba4d3f74
Sergey A. Osokin (osa) · 5.8.8
sysutils/podman: security update to 5.8.8

PR:		299321
Approved by:	dfr (maintainer)
Security:	CVE-2026-94603

Sponsored by:	tipi.work
5d91ae7544
Sergey A. Osokin (osa) · 5.8.6_2
sysutils/podman: remove an incorporated patch

Bump PORTREVISION.

PR:		298016
Approved by:	dfr (maintainer timeout >3 weeks)

Sponsored by:	tipi.work
80ccc5d4a2
Adam Weinberger (adamw) · 5.8.6_1
many: Bump go ports for 1.26.8 and 1.27.1
dd0905142a
Sergey A. Osokin (osa) · 5.8.6
sysutils/podman: update to 5.8.6

PR:		297652
Approved by:	dfr (maintainer)

Sponsored by:	tipi.work
b0ba85f3a4
Dag-Erling Smørgrav (des) · 5.8.4_3 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.14 / 1.26.7
4867821cd6
Dag-Erling Smørgrav (des) · 5.8.4_2 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.13 / 1.26.6
6d39dcf04e
Dag-Erling Smørgrav (des) · 5.8.4_1
various: Drop Go 1.25+ version pin

This is a nop since 1.25 is the oldest version we support.
4a24b8eb7f
Dag-Erling Smørgrav (des) · 5.8.4_1 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.12 / 1.26.5
4ea3547132
Dave Cottlehuber (dch) · 5.8.4
sysutils/podman: Fix build by blocking fetching newer go over network

Go insists on trying to download a newer toolchain, as the default is currently 1.24,
and this version of podman requires 1.25 or newer. The MAKE_ENV flag is described
here in nauseating detail https://go.dev/doc/toolchain .
712a103c3d
Dave Cottlehuber (dch) · 5.8.4
sysutils/podman: Update to v5.8.4

Include merged https://github.com/podman-container-tools/container-libs/pull/935

Approved by:	dfr
Obtained from:	Michael Johnson <buhnux@gmail.com>
Sponsored by:	SkunkWerks, GmbH
Differential Revision:	https://reviews.freebsd.org/D57946

Reported by:
d45ed3450e
Dave Cottlehuber (dch) · 5.8.3
sysutils/podman: Update to v5.8.3

Approved by:	dfr
Security:	CVE-2026-44517
Sponsored by:	SkunkWerks, GmbH
Differential Revision:	https://reviews.freebsd.org/D57735
c5a63e7e48
Dag-Erling Smørgrav (des) · 5.8.2_2
various: Bump go ports for go-1.25.11 / go-1.26.4
dd8dc2a59d
Adam Weinberger (adamw) · 5.8.2_1
various: Bump ports for Go 1.25.10
4e243a83f8
Sergey A. Osokin (osa) · 5.8.2
sysutils/podman: update: 5.8.1 -> 5.8.2

ChangeLog:	https://github.com/containers/podman/compare/v5.8.1...v5.8.2

PR:		294530
Approved by:	dfr (maintainer)

Sponsored by:	tipi.work
c341001a9a
Dag-Erling Smørgrav (des) · 5.8.1_2
various: Bump go ports for go-1.25.9 / 1.26.2
7507e72a84
Dave Cottlehuber (dch) · 5.8.1_1
sysutils/podman: Fix panic when using network=host

If using host-based networking, instead of default VNET, some podman commands
including inspect could fail:

podman run -d --network=host ghcr.io/freebsd/freebsd-notoolchain:15.0 /bin/sh
podman inspect --latest

See https://github.com/containers/podman/issues/28289 for details.

While here, appease portclippy & portfmt

Reviewed by:	dfr
Obtained from:	dfr
Sponsored by:	SkunkWerks, GmbH
ec26aa92da
Sergey A. Osokin (osa) · 5.8.1
sysutils/podman: update: 5.8.0 -> 5.8.1

Approved by:	dfr (maintainer)
PR:		293764

Sponsored by:	tipi.work
5072493446
Dave Cottlehuber (dch) · 5.8.0_1
sysutils/podman: Allow setting ownership on auto-created socket

The podman_service daemon auto-creates a socket on startup, along with
parent directory, and is always run as root. It is often useful to have
another proxy like haproxy or nginx provide more sophisticed security,
and these daemons do not need root privileges.

Approved by:	dfr
Reported by:	pat@patmaddox.com
Tested by:	arrowd
Differential Revision:	https://reviews.freebsd.org/D55455
04b7363110
Sergey A. Osokin (osa) · 5.8.0
sysutils/podman: update: 5.7.1 -> 5.8.0

PR:		293609
Approved by:	dfr (maintainer)

Sponsored by:	tipi.work
ad319903ff
Adam Weinberger (adamw) · 5.7.1_4
various: Bump ports for Go 1.25.8
a8d318da7c
Dave Cottlehuber (dch) · 5.7.1_3
sysutils/podman: Revert "Allow setting ownership on auto-created socket"

This works functionally, but is being managed by the incorrect daemon.
Podman alone simply ensures auto-start of containers; podman_service
provides the API. This will be corrected in an upcoming commit.

This reverts commit 2c53428ae117108d41eb4e19935ed98b478f4f7f.
0882ac8e21
Dave Cottlehuber (dch) · 5.7.1_4
sysutils/podman: Allow setting ownership on auto-created socket

The podman daemon auto-creates a socket on startup, along with parent
directory, and is always run as root. It is often useful to have another
proxy like haproxy or nginx provide more sophisticed security, and these
daemons do not need root privileges.

Differential Revision:	https://reviews.freebsd.org/D55339

Reviewed by:	arrowd
Approved by:	dfr
2c53428ae1
Adam Weinberger (adamw) · 5.7.1_3
various: Bump ports for Go default 1.24->1.25
97685c1886
Adam Weinberger (adamw) · 5.7.1_2
various: Bump Go ports for 1.24.13
529df949a5
Adam Weinberger (adamw) · 5.7.1_1
various: Bump Go ports for 1.24.12
013f2d30b0
Dag-Erling Smørgrav (des) · 5.7.1
many: Unpin Go ports

Unpin Go ports that I missed the first time around because the version
number was not the first argument.

Fixes:		75d873b56a74 ("many: Unpin Go ports")
3d901a5fec
Sergey A. Osokin (osa) · 5.7.1
sysutils/podman: update 5.7.0 -> 5.7.1

Remove the upstreamed patch.

PR:		291493
Approved by:	dfr (maintainer)

Sponsored by:	tipi.work
b3660def03
Adam Weinberger (adamw) · 5.7.0_1
various: Bump Go ports for 1.24.11
b24429e3ed
Sergey A. Osokin (osa) · 5.7.0
sysutils/podman: update 5.6.2 -> 5.7.0

Thanks Doug Rabson for his review and an additional patch, that's also
heading upstream, https://github.com/containers/podman/pull/27545

Approved by:	dfr (maintainer)
Reviewed by:	dfr (maintainer)
ChangeLog:	https://github.com/containers/podman/compare/v5.6.2...v5.7.0
PR:		291014

Sponsored by:	tipi.work
89819fbca0
Sergey A. Osokin (osa) · 5.6.2
sysutils/podman-suite: update to the 20251001 snapshot

Also, update podman-related components:
- sysutils/buildah: 1.41.4 -> 1.41.5
- sysutils/containters-common: 0.64.1 -> 0.64.2
- sysutils/podman: 5.6.1 -> 5.6.2

PR:		289962
Approved by:	dfr (maintainer)
203d1a6241
Sergey A. Osokin (osa) · 5.6.1
sysutils/*: update podman-suite to the recent snapshot

The update includes updates for:
- sysutils/podman to 5.6.1
- sysutils/containers-common, image component to 5.36.2

PR:		289330
Tested by:	dfr (maintainer)
Approved by:	dfr (maintainer)
b3cca84c74
Sergey A. Osokin (osa) · 5.6.0
sysutils/podman-suite: update to 20250820

This update contains updates of the following components:
- sysutils/buildah from 1.40.1 to 1.41.3
- sysutils/containers-common from 0.63.1 to 0.64.1
- systutils/podman from 5.5.2 to 5.6.0
- systutils/skopeo from 1.19.0 to 1.20.0

PR:		288990
Approved by:	dfr (maintainer)
2b86a5a3ce
Adam Weinberger (adamw) · 5.5.2_1
go123 ports: Bump for 1.23.12
b6703954e3
Sergey A. Osokin (osa) · 5.5.2
sysutils/podman: security update from 5.5.1 to 5.5.2

While I'm here remove the workarounds since the port buils just fine
without those.

ChangeLog:	https://github.com/containers/podman/compare/v5.5.1...v5.5.2

Approved by:	dfr (maintainer)
PR:		287812
6cc26782fc
Sergey A. Osokin (osa) · 5.5.1
sysutils/*: update podman-suite to the 20250618

These components have been updated:
- buildah from 1.38.1 to 1.40.1
- podman from 5.3.2 to 5.5.1
- skopeo from 1.17.0 to 1.19.0

PR:			287607
Approved by:		dfr (maintainer)
Differential Revision:	https://reviews.freebsd.org/D49184
9ee49c5fdf
Jason E. Hale (jhale) · 5.3.2_3
*/*: Bump security/gpgme consumers
dbab074be0
Adam Weinberger (adamw) · 5.3.2_2
go: Bump ports for go124 update
a4e30d4f4f
Adam Weinberger (adamw) · 5.3.2_1
Bump all go ports for yesterday's releases
d0642a6176
Doug Rabson (dfr) · 5.3.2
sysutils/podman: update to 5.3.2

This also changes the image path in pkg-message to
quay.io/dougrabson/hello to avoid rate limiting.
174a164caf
Sergey A. Osokin (osa) · 5.2.5_2
sysutils/podman: reduce the number of warnings during the build time

... by updating the list of dependencies.

Bump PORTREVISION.

Differential Revision:	https://reviews.freebsd.org/D47926
c1b8fb6a7e
Sergey A. Osokin (osa) · 5.2.5_1
*/*: update licences for podman-related infra

Most of of the products, except ocijail, are under Apache 2.0.

Add licence files.
Bump PORTREVISIONs.

Approved by:		dfr (maintainer)
Differential Revision:	https://reviews.freebsd.org/D47924
2aa122875d
Sergey A. Osokin (osa) · 5.2.5
sysutils/podman: update from 5.1.1 to 5.2.5

Approved by:		dfr (maintainer)
Differential Revision:	https://reviews.freebsd.org/D47877
c8e77928f4
Doug Rabson (dfr) · 5.1.1_7
sysutils/podman: fix a confusing error message from 'podman system reset'
859efd10b6
Doug Rabson (dfr) · 5.1.1_6
sysutils/podman: minor fix to the output of 'podman inspect'

The HostConfig.Devices field was set to null which confused some code in
ansible's podman_container module which expects this field to be an
array of srtings.
f570a53c11
Doug Rabson (dfr) · 5.1.1_5
sysutils/podman: fix support for 'podman image load' and 'podman image save'

The code assumed that the faccessat syscall supports AT_SYMLINK_NOFOLLOW
which is not the case in FreeBSD before 15.0.
a84498685c
Doug Rabson (dfr) · 5.1.1_4
sysutils/podman: fix nil pointer dereference in 'podman build'

This copies over fixes for a similar problem in Buildah - Podman shares
Buildah code to implement 'podman build'.
099c6a40f8