Critical Security Update for osbuild-composer: IPv6 Host Literal Parsing Vulnerability
Summary
ALSA-2026:8456: Important: osbuild-composer security update. Affects osbuild-composer versions < 101.4-5.el8_10.alma.1. Fixed in 101.4-5.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, such as virtual machine images and OSTree commits. It leverages osbuild to facilitate the creation of these images, which can be used locally or uploaded directly to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators. However, it has recently been identified as vulnerable to a security issue that affects the parsing of IPv6 host literals.
Vulnerability Detail
The vulnerability, identified as CVE-2026-25679, stems from an incorrect parsing mechanism in the net/url package. This flaw can lead to potential security risks, including the possibility of unauthorized access or manipulation of network requests that utilize IPv6 addresses. The ramifications of this vulnerability could be severe, particularly in environments where secure communications are critical.
How To Fix
Minimum fixed version
101.4-5.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using IPv6 host literals in their configurations until the packages are updated. This may involve modifying network settings or application configurations to rely solely on IPv4 addresses.
Conclusion
In summary, the osbuild-composer package has a critical vulnerability related to IPv6 host literal parsing, which can lead to significant security risks. It is crucial to update the affected packages to the latest patched version to mitigate these risks. Additionally, users can utilize Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for osbuild-composer →
FAQ
CVE-2026-25679 is a security vulnerability related to incorrect parsing of IPv6 host literals in the net/url package used by osbuild-composer.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access and manipulation of network requests that utilize IPv6 addresses, which could compromise the security of your applications.
You can update the affected packages by running the command: sudo dnf update osbuild-composer osbuild-composer-core osbuild-composer-worker.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
