[ALSA-2026:49526] Important: osbuild-composer security update
Type:
security
Severity:
important
Release date:
2026-08-13
Description:
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 osbuild-composer-165.1-3.el10_2.1.alma.3.aarch64.rpm 954f666de69e01435f4ddc563bc02109abe9da1f496fad627ec2bc03a12a3447
aarch64 osbuild-composer-worker-165.1-3.el10_2.1.alma.3.aarch64.rpm cbb7a995b66054ab226ae742fb86c13985d51c0b26b95cd1333caba0d94821db
aarch64 osbuild-composer-core-165.1-3.el10_2.1.alma.3.aarch64.rpm d03914881df18ac885947ef174a74f3d95edb20d3993a67c8b7cfb3ce95ec0dd
ppc64le osbuild-composer-worker-165.1-3.el10_2.1.alma.3.ppc64le.rpm 82366de598e52cb32e85587a80fe2bda6b3e6f63020ef763989e14cb2416144f
ppc64le osbuild-composer-165.1-3.el10_2.1.alma.3.ppc64le.rpm 91ef09a5a6edd3c4ea93f605e1c33496f57d19addc5298ddfd4fb6e410c3f9f9
ppc64le osbuild-composer-core-165.1-3.el10_2.1.alma.3.ppc64le.rpm caf9cf82f26b40c0d0abe401bd9f13a4fdee3111d3921ccf5f17292d1713ba17
s390x osbuild-composer-core-165.1-3.el10_2.1.alma.3.s390x.rpm 210bf6171bba068b9bb36bc5fee84a5be74202a4db2a5061dbc7d4a399989bf4
s390x osbuild-composer-165.1-3.el10_2.1.alma.3.s390x.rpm 7c4588276e0149781e7b44ee2ab8172701ce8b65d215a29a3b858649815549d4
s390x osbuild-composer-worker-165.1-3.el10_2.1.alma.3.s390x.rpm 820c7f9d6bcf261bc91631b68b7ec375438cf5d90c6b3f8daf0e5f9f2c1d12d4
x86_64 osbuild-composer-165.1-3.el10_2.1.alma.3.x86_64.rpm 03c79859705becd4ad705e747c6201c560b0bf31fae92624f9886fbe5134d974
x86_64 osbuild-composer-core-165.1-3.el10_2.1.alma.3.x86_64.rpm c94f2c184912df1ffff1e4038b79a10868bd546914f84b38fbdbfd5b18311d50
x86_64 osbuild-composer-worker-165.1-3.el10_2.1.alma.3.x86_64.rpm eb4c7cfebb17f8dfa298823849f9432a320b2797befd4fb6ee82cc6d6a4a24e9
x86_64_v2 osbuild-composer-core-165.1-3.el10_2.1.alma.3.x86_64_v2.rpm 290cd3932ad7a5738892690cc85374e2dcf75068cffe30bdd96f43d7ff01c7bb
x86_64_v2 osbuild-composer-165.1-3.el10_2.1.alma.3.x86_64_v2.rpm 5ed5ad0f0d5dc36c80efa92d1fe48135a864c9e0880e09f680733c8ef096cebd
x86_64_v2 osbuild-composer-worker-165.1-3.el10_2.1.alma.3.x86_64_v2.rpm ea9b002913de51b6a465c48b1996f0eab0262f3b1b77a2d28a25e8423db94621
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.