git: 5557b3614aec - main - security/vuxml: Document podman vulnerability

The branch main has been updated by osa:

URL: https://cgit.FreeBSD.org/ports/commit/?id=5557b3614aec35eadb8239bd2e5cdf07297a7723

commit 5557b3614aec35eadb8239bd2e5cdf07297a7723
Author:     Sergey A. Osokin <osa@FreeBSD.org>
AuthorDate: 2026-10-12 00:48:11 +0000
Commit:     Sergey A. Osokin <osa@FreeBSD.org>
CommitDate: 2026-10-12 00:48:11 +0000

    security/vuxml: Document podman vulnerability
---
 security/vuxml/vuln/2026.xml | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml
index a7582889dfdd..b82da47fd444 100644
--- a/security/vuxml/vuln/2026.xml
+++ b/security/vuxml/vuln/2026.xml
@@ -1,3 +1,38 @@
+  <vuln vid="bb4528f4-c5d4-11f1-8c8c-ac5afc632ba3">
+    <topic>podman -- vulnerabilities</topic>
+    <affects>
+	<package>
+	<name>podman</name>
+	<range><lt>5.8.8</lt></range>
+	</package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>The Podman developers report:</p>
+	<blockquote cite="https://github.com/podman-container-tools/podman/releases/tag/v5.8.8">
+	  <p>This release addresses (CVE-2026-94603), where a
+	  "podman run" on a checkpoint image (any image with the
+	  io.podman.annotations.checkpoint.runtime.name annotation) could
+	  disable all sandboxing, including sandboxing specified by the
+	  user, when the container was created.</p>
+	  <p>Removed support for checkpoint images in podman run due to
+	  serious security concerns with the different security models of
+	  running images and running checkpoints. Checkpoints ignore
+	  user-specified security configuration and are very difficult to
+	  run safely.</p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2026-94603</cvename>
+      <url>https://github.com/podman-container-tools/podman/releases/tag/v5.8.8</url>
+    </references>
+    <dates>
+      <discovery>2026-10-11</discovery>
+      <entry>2026-10-11</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="0f5aaca7-c4d5-11f1-96b4-74563cf85f9d">
     <topic>py-WsgiDAV -- Multiple vulnerabilities</topic>
     <affects>