Critical Security Update for osbuild-composer: Denial of Service Vulnerabilities
Summary
ALSA-2026:49838: Important: osbuild-composer security, bug fix, and enhancement update. Affects osbuild-composer versions < 165.1-4.el9_8.alma.1. Fixed in 165.1-4.el9_8.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, such as virtual machine images and OSTree commits. It leverages osbuild to facilitate the creation of these images, which can be used locally or uploaded directly to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators.
Vulnerability Detail
The vulnerabilities identified in osbuild-composer stem from issues in the Go crypto/x509 and crypto/tls libraries, which can lead to Denial of Service (DoS) attacks. Specifically, CVE-2026-32280 and CVE-2026-32281 highlight inefficient certificate chain validation and vulnerabilities in certificate chain building. These issues can be exploited by an attacker to cause the service to become unresponsive, impacting the availability of the system and potentially leading to service disruptions.
How To Fix
Minimum fixed version
165.1-4.el9_8.alma.1
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. It is recommended to apply the updates as soon as they are available to mitigate the risks associated with these vulnerabilities.
Conclusion
The vulnerabilities in osbuild-composer pose significant risks due to potential Denial of Service attacks. It is imperative for users to update their packages to the latest patched versions to ensure the security and availability of their systems.
See every vulnerability recorded for osbuild-composer →
FAQ
osbuild-composer is a service that builds customized OS artifacts, such as VM images and OSTree commits, using osbuild.
The vulnerabilities are CVE-2026-32280 and CVE-2026-32281, which relate to Denial of Service attacks due to inefficient certificate chain validation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to avoid potential service disruptions.
More details about the vulnerabilities can be found on the CVE pages listed in the references section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
