Critical Security Update for osbuild-composer: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:48790: Important: osbuild-composer security update. Affects osbuild-composer versions < 101.5-1.el8_10.alma.1. Fixed in 101.5-1.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, such as virtual machine images and OSTree commits. It utilizes osbuild for its operations and is capable of uploading images directly to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators. However, recent vulnerabilities have been identified that could compromise the security and functionality of the service.
Vulnerability Detail
The vulnerabilities in osbuild-composer stem from various components, including gRPC-Go, Go JOSE, and Go crypto libraries. Notable issues include an authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186), a denial of service via crafted JSON Web Encryption (CVE-2026-34986), and multiple denial of service vulnerabilities in TLS and certificate chain building (CVE-2026-32280, CVE-2026-32283). These vulnerabilities could allow attackers to exploit the service, potentially leading to unauthorized access, service disruption, or data compromise.
How To Fix
Minimum fixed version
101.5-1.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the osbuild-composer service and monitor for unusual activity until the update can be applied. Additionally, consider implementing network-level security measures to limit exposure to potential attacks.
Conclusion
The identified vulnerabilities in osbuild-composer pose significant risks to users and their systems. It is crucial to apply the necessary updates to mitigate these risks and ensure the security and functionality of the service. By staying informed and proactive, users can protect their environments from potential threats.
See every vulnerability recorded for osbuild-composer →
FAQ
osbuild-composer is a service for building customized OS artifacts, such as VM images and OSTree commits, using osbuild.
Several vulnerabilities have been identified, including authorization bypass, denial of service via crafted JSON Web Encryption, and issues in TLS and certificate chain building.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring signup.
If immediate updates are not possible, implement network-level security measures and restrict access to the osbuild-composer service as a temporary workaround.
For detailed information about the vulnerabilities, refer to the CVE pages linked in the advisory or the official documentation of osbuild-composer.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
