Security Update for osbuild-composer: Important IPv6 Parsing Vulnerability
Summary
ALSA-2026:9044: Important: osbuild-composer security update. Affects osbuild-composer versions < 149-5.el9_7.alma.3. Fixed in 149-5.el9_7.alma.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, such as virtual machine images and OSTree commits. It leverages osbuild for image creation and supports direct uploads to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators working with AlmaLinux 9.
Vulnerability Detail
The vulnerability identified as CVE-2026-25679 pertains to an incorrect parsing of IPv6 host literals in the net/url package. This flaw could potentially allow attackers to exploit the parsing mechanism, leading to unauthorized access or manipulation of network requests. The implications of this vulnerability could range from denial of service to more severe security breaches, depending on the attack vector utilized.
How To Fix
Minimum fixed version
149-5.el9_7.alma.3
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected service until the update is applied. This can be done by modifying firewall rules to limit incoming connections to trusted IP addresses only.
Conclusion
The osbuild-composer security update addresses a critical vulnerability related to IPv6 parsing. It is crucial for users to update their packages to the latest version to protect against potential exploits. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for osbuild-composer →
FAQ
CVE-2026-25679 is a security vulnerability related to incorrect parsing of IPv6 host literals in the net/url package used by osbuild-composer.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
The consequences can include unauthorized access, manipulation of network requests, and potential denial of service, depending on how the vulnerability is exploited.
Yes, a patch is available. Update to version 149-5.el9_7.alma.3 for osbuild-composer and its related packages to mitigate the vulnerability.
If immediate updating is not possible, consider implementing firewall rules to restrict access to the affected services as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
