Critical Security Update for osbuild-composer: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:3753: Important: osbuild-composer security update. Affects osbuild-composer versions < 149-4.el9_7.alma.3. Fixed in 149-4.el9_7.alma.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized OS artifacts, such as virtual machine images and OSTree commits. It utilizes osbuild for image creation and supports direct uploads to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators. However, recent vulnerabilities have been identified that could compromise the security and stability of systems using this package.
Vulnerability Detail
The vulnerabilities stem from various components within the osbuild-composer package and its dependencies. Notable issues include a Denial of Service (DoS) due to excessive resource consumption from crafted certificates (CVE-2025-61729), excessive CPU usage when building archive indexes (CVE-2025-61728), memory exhaustion during query parameter parsing (CVE-2025-61726), and unexpected session resumption in TLS (CVE-2025-68121). These vulnerabilities could lead to service disruptions, degraded performance, and potential unauthorized access to sensitive data.
How To Fix
Minimum fixed version
149-4.el9_7.alma.3
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the resources allocated to the osbuild-composer service to mitigate the impact of the vulnerabilities until a full update can be applied. This can be done by adjusting the service configuration in your system's service manager.
Conclusion
The identified vulnerabilities in osbuild-composer pose significant risks to system stability and security. It is crucial for users to update their packages to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities effectively.
See every vulnerability recorded for osbuild-composer →
FAQ
osbuild-composer is a service that builds customized OS artifacts, such as VM images and OSTree commits, utilizing osbuild.
The vulnerabilities include Denial of Service, excessive CPU consumption, memory exhaustion, and unexpected TLS session resumption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing resource limitations on the osbuild-composer service as a temporary workaround.
For detailed information about the vulnerabilities, refer to the CVE pages listed in the advisory or consult the AlmaLinux security database.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
