Critical Security Update for osbuild-composer: Addressing Memory Exhaustion and TLS Session Resumption Vulnerabilities
Summary
ALSA-2026:3898: Important: osbuild-composer security update. Affects osbuild-composer versions < 101.4-4.el8_10.alma.1. Fixed in 101.4-4.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, such as virtual machine images and OSTree commits. It leverages osbuild for image creation and supports direct uploads to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators. However, it has recently been identified as vulnerable to critical security issues that could impact its functionality and security.
Vulnerability Detail
The vulnerabilities stem from two main issues: a memory exhaustion flaw in the net/url package during query parameter parsing (CVE-2025-61726) and an unexpected session resumption issue in the crypto/tls package (CVE-2025-68121). These vulnerabilities could allow an attacker to exploit the service, potentially leading to denial of service or unauthorized access to sensitive data. The implications of these vulnerabilities are significant, as they could compromise the integrity and availability of the services relying on osbuild-composer.
How To Fix
Minimum fixed version
101.4-4.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if you are unable to update immediately, consider restricting access to the osbuild-composer service to trusted networks only, thereby minimizing exposure to potential attacks until the update can be applied.
Conclusion
In summary, the osbuild-composer package has critical vulnerabilities that require immediate attention. By updating to the latest patched version, users can protect their systems from potential exploits. It is also advisable to monitor applications for vulnerabilities using tools like Vulert to ensure ongoing security.
See every vulnerability recorded for osbuild-composer →
FAQ
The main vulnerabilities are a memory exhaustion issue in query parameter parsing and an unexpected session resumption in TLS, which could lead to denial of service or unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
As a workaround, restrict access to the osbuild-composer service to trusted networks to minimize exposure until you can apply the update.
The patched version for the affected packages is 101.4-4.el8_10.alma.1 or later.
For more details, refer to the CVE pages for CVE-2025-61726 and CVE-2025-68121, which provide in-depth information about the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
