Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
osbuild-composer can let attackers run code or steal data
published 1 month ago
Summary
The osbuild-composer tools used to create custom operating system images may contain several coding errors that could allow a malicious user to execute commands, view private information, or cause the service to stop working. This affects the Almalinux osbuild-composer, osbuild-composer-core, and osbuild-composer-worker packages. Install the latest security update from the vendor as soon as possible to protect your systems.
What to do
- Update almalinux osbuild-composer to version 165.1-5.el10_2.alma.1.
- Update almalinux osbuild-composer-core to version 165.1-5.el10_2.alma.1.
- Update almalinux osbuild-composer-worker to version 165.1-5.el10_2.alma.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | osbuild-composer |
< 165.1-5.el10_2.alma.1 Fix: upgrade to 165.1-5.el10_2.alma.1
|
| AlmaLinux:10 | almalinux | osbuild-composer-core |
< 165.1-5.el10_2.alma.1 Fix: upgrade to 165.1-5.el10_2.alma.1
|
| AlmaLinux:10 | almalinux | osbuild-composer-worker |
< 165.1-5.el10_2.alma.1 Fix: upgrade to 165.1-5.el10_2.alma.1
|
Original advisory text
Important: osbuild-composer security update
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.
Security Fix(es):
* golang.org/x/net/idna: golang: net/[http:](http:) golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)
* github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
* github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* golang.org/x/net/idna: golang: net/[http:](http:) golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)
* github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
* github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:66432 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-39821 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-41178 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-42502 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-55677 Third Party Advisory
- https://bugzilla.redhat.com/2480756 Third Party Advisory
- https://bugzilla.redhat.com/2480757 Third Party Advisory
- https://bugzilla.redhat.com/2480761 Third Party Advisory
- https://bugzilla.redhat.com/2480762 Third Party Advisory
- https://bugzilla.redhat.com/2484830 Third Party Advisory
- https://bugzilla.redhat.com/2493622 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-66432.html Vendor Advisory
Timeline
Published10 Sep 2026
Updated5 Oct 2026
First seen5 Oct 2026
Sources
ALSA-2026:66432 · OSV
Track software like this
Free during beta