Critical Security Update for osbuild-composer: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:67148: Important: osbuild-composer security update. Affects osbuild-composer versions < 101.5-3.el8_10.alma.1. Fixed in 101.5-3.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, including VM images and OSTree commits. It leverages osbuild to facilitate the creation of images for both local use and direct uploads to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators. However, recent vulnerabilities have been identified that could compromise the security and stability of the service.
Vulnerability Detail
The vulnerabilities stem from various components within the Go programming language libraries utilized by osbuild-composer. Notable issues include a timing sidechannel vulnerability in the P-256 algorithm (CVE-2025-22866), denial of service risks due to inefficient certificate chain validation (CVE-2026-32281), and multiple denial of service vulnerabilities related to email address parsing and MIME header processing (CVE-2026-42499, CVE-2026-42504). Additionally, there is an unauthorized information disclosure risk via URL path decoding discrepancies (CVE-2026-55677). These vulnerabilities could lead to service disruptions, unauthorized access to sensitive information, and overall system instability.
How To Fix
Minimum fixed version
101.5-3.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the osbuild-composer service and monitoring for unusual activity until the update can be applied. Additionally, validate all incoming data to mitigate potential denial of service attacks.
Conclusion
The identified vulnerabilities in osbuild-composer pose significant risks that could affect the security and functionality of systems relying on this service. It is crucial to apply the recommended updates promptly and consider temporary workarounds to mitigate risks until the updates are implemented.
See every vulnerability recorded for osbuild-composer →
FAQ
osbuild-composer is a service that helps create customized OS artifacts, such as VM images and OSTree commits, using osbuild.
The vulnerabilities include timing sidechannel issues, denial of service risks from inefficient certificate validation, and unauthorized information disclosure.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
As a workaround, restrict access to the osbuild-composer service and validate incoming data to reduce the risk of exploitation.
For detailed information, refer to the CVE pages listed in the related section of the vulnerability advisory.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
