Critical Security Update for osbuild-composer: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:66432: Important: osbuild-composer security update. Affects osbuild-composer versions < 165.1-5.el10_2.alma.1. Fixed in 165.1-5.el10_2.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, such as virtual machine images and OSTree commits. It leverages osbuild to facilitate the creation of these images, which can be used locally or uploaded directly to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing this package.
Vulnerability Detail
The vulnerabilities in osbuild-composer stem from various components, including the golang.org/x/net/idna and golang.org/x/net/html packages. These vulnerabilities include privilege escalation due to incorrect Punycode label processing (CVE-2026-39821), cross-site scripting (XSS) vulnerabilities that could lead to arbitrary code execution (CVE-2026-25681), and denial of service via oversized baggage headers (CVE-2026-41178). The ramifications of these vulnerabilities could range from unauthorized access to sensitive information to complete system compromise.
How To Fix
Minimum fixed version
165.1-5.el10_2.alma.1
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the osbuild-composer service to trusted users only, thereby minimizing the risk of exploitation until the package is updated. Additionally, consider implementing web application firewalls to mitigate the impact of potential cross-site scripting attacks.
Conclusion
The osbuild-composer package has critical vulnerabilities that need to be addressed promptly to ensure the security of systems utilizing this service. Updating to the latest patched version is essential, and users should consider implementing workarounds to mitigate risks until updates can be applied.
See every vulnerability recorded for osbuild-composer →
FAQ
The main vulnerabilities include privilege escalation, cross-site scripting, and denial of service, affecting various components of the package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If an immediate update is not possible, restrict access to the service and implement security measures such as web application firewalls to reduce risk.
Detailed information can be found on the CVE pages linked in the advisory, which provide insights into the impact and technical details of each vulnerability.
Yes, you can use the Vulert playground to monitor vulnerabilities in your application without requiring installation or signup.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
