[ALSA-2026:66432] Important: osbuild-composer security update
Type:
security
Severity:
important
Release date:
2026-10-05
Description:
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * golang.org/x/net/idna: golang: net/[http:](http:) golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 osbuild-composer-core-165.1-5.el10_2.alma.1.aarch64.rpm 053b41a97a2fa83fcdda793444eed56cce066493ce50588362e64ea00cbade12
aarch64 osbuild-composer-165.1-5.el10_2.alma.1.aarch64.rpm 62f26eb922c5d07bb9413e11bb5ba9f9a71152892e88b332ca503ef0b9d3220b
aarch64 osbuild-composer-worker-165.1-5.el10_2.alma.1.aarch64.rpm 69b5098870e83cebb11fac23b400a692c62774bbce94b31887fb77e8eff47868
ppc64le osbuild-composer-worker-165.1-5.el10_2.alma.1.ppc64le.rpm 14d665821def007dc7ded246bf3e2031ec3ae56a29eb758f0e991183a0d49488
ppc64le osbuild-composer-165.1-5.el10_2.alma.1.ppc64le.rpm 6213c1b8b182a5378610ea15bbbee3dbfae1e42ffd636f28e7eb43f8bebf475e
ppc64le osbuild-composer-core-165.1-5.el10_2.alma.1.ppc64le.rpm 9127badee0841dae0423d7b14b37c2be4354b8e1c2fee9ab98e1c8ca1720048f
s390x osbuild-composer-165.1-5.el10_2.alma.1.s390x.rpm 606e90085c81793eaade1cf901866058a9cd57d0f2f270b63bb4226ab30bd9bb
s390x osbuild-composer-core-165.1-5.el10_2.alma.1.s390x.rpm a228acfc655264dcb1c13620f0495580cfcc4da04d02a17765374e3dc527c073
s390x osbuild-composer-worker-165.1-5.el10_2.alma.1.s390x.rpm f089b0207f426cc99f87a7e8013af313066e73333300acde754fdf83f0ba9471
x86_64 osbuild-composer-165.1-5.el10_2.alma.1.x86_64.rpm c12f314fce2ed0e5fd0d237eafa6bdcfeaf622cee712cdd8f9ae2485ca814245
x86_64 osbuild-composer-core-165.1-5.el10_2.alma.1.x86_64.rpm c4b15f55b7b61dd1844442c7fbdfac45524671a6aecf2a16e5664470a04ddb77
x86_64 osbuild-composer-worker-165.1-5.el10_2.alma.1.x86_64.rpm e1c7fd284f1fce8b539464468e3b2212446d881aebb97cf256e1713054095542
x86_64_v2 osbuild-composer-165.1-5.el10_2.alma.1.x86_64_v2.rpm 172f55d607891f8bffaea2ae51b8a76948084b3e5b39e03a5d5c0df3d76003bb
x86_64_v2 osbuild-composer-worker-165.1-5.el10_2.alma.1.x86_64_v2.rpm 96937c5cbc4cddd07d002c113cd84e37e9b3f1173e13811aab11cee38dbd8bc9
x86_64_v2 osbuild-composer-core-165.1-5.el10_2.alma.1.x86_64_v2.rpm f16bb4a094ba68fb71aac935d3b7c486c2c632a6e51573f6505d467e6a8d92d3
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.