Critical Security Update for osbuild-composer: Denial of Service Vulnerabilities
Summary
ALSA-2026:49526: Important: osbuild-composer security update. Affects osbuild-composer versions < 165.1-3.el10_2.1.alma.3. Fixed in 165.1-3.el10_2.1.alma.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, such as virtual machine images and OSTree commits. It operates using osbuild and supports direct uploads to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators. However, recent vulnerabilities have been identified that could potentially compromise the security and performance of systems utilizing this package.
Vulnerability Detail
The vulnerabilities identified in osbuild-composer are related to Denial of Service (DoS) attacks stemming from inefficient certificate chain validation and issues in certificate chain building. Specifically, CVE-2026-32281 and CVE-2026-32280 expose the system to potential service disruptions, as attackers could exploit these weaknesses to overwhelm the service, leading to degraded performance or complete service unavailability. These vulnerabilities arise from the Go crypto/x509 and crypto/tls libraries used within the package.
How To Fix
Minimum fixed version
165.1-3.el10_2.1.alma.3
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for mitigating these vulnerabilities aside from applying the necessary updates. It is recommended to monitor the service closely until the updates can be applied.
Conclusion
In summary, the osbuild-composer package has critical vulnerabilities that could lead to Denial of Service attacks. It is crucial to update to the latest patched version to ensure the security and stability of your systems. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for osbuild-composer →
FAQ
The main vulnerabilities are related to Denial of Service attacks due to inefficient certificate chain validation and issues in certificate chain building.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The vulnerabilities can lead to service disruptions, causing degraded performance or complete unavailability of the osbuild-composer service.
Yes, a patch is available. Update to version 165.1-3.el10_2.1.alma.3 to mitigate the vulnerabilities.
If immediate updates are not possible, monitor the service closely for any unusual activity and plan to apply the updates as soon as feasible.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
