Critical Security Vulnerability in osbuild-composer: Multiple Cross-Site Scripting and Denial of Service Issues
Summary
RLSA-2026:69293: Important: osbuild-composer security update. Affects osbuild-composer versions < 0:165.1-5.el9_8.rocky.0.1. Fixed in 0:165.1-5.el9_8.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, such as virtual machine images and OSTree commits. It utilizes osbuild for image creation and supports direct uploads to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing this package.
Vulnerability Detail
The vulnerabilities stem from multiple issues in the golang.org/x/net/html and github.com/open-telemetry/opentelemetry-go packages. These include Cross-Site Scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code through HTML parsing bypass, unexpected HTML tree rendering, and unauthorized information disclosure via URL path decoding discrepancies. Additionally, a Denial of Service (DoS) vulnerability exists due to oversized baggage headers in OpenTelemetry-Go. The ramifications of these vulnerabilities can lead to severe security breaches, including data theft and application downtime.
How To Fix
Minimum fixed version
0:165.1-5.el9_8.rocky.0.1
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement input validation and sanitization to mitigate the risk of Cross-Site Scripting attacks. Additionally, limit the size of baggage headers to prevent Denial of Service attacks. However, these are not substitutes for applying the official patch.
Conclusion
The identified vulnerabilities in osbuild-composer pose significant risks to applications utilizing this package. It is crucial to update to the patched version to safeguard against potential exploits. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for osbuild-composer →
FAQ
osbuild-composer is a service for building customized OS artifacts, including VM images and OSTree commits, using osbuild.
The vulnerabilities include Cross-Site Scripting (XSS) and Denial of Service (DoS) issues, which can lead to code execution and application downtime.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
Implement input validation and limit baggage header sizes as temporary workarounds until you can apply the official patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
