Critical Security Update for osbuild-composer: IPv6 Host Literal Parsing Vulnerability
Summary
ALSA-2026:13643: Important: osbuild-composer security update. Affects osbuild-composer versions < 149-6.el10_1.alma.3. Fixed in 149-6.el10_1.alma.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, such as virtual machine images and OSTree commits. It leverages osbuild for its operations and supports direct uploads to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators who need to create tailored OS images efficiently.
Vulnerability Detail
The vulnerability identified as CVE-2026-25679 pertains to incorrect parsing of IPv6 host literals in the net/url package used by osbuild-composer. This flaw can lead to potential security risks, including the possibility of unauthorized access or manipulation of network requests, which could compromise the integrity of the system and its data. The vulnerability arises from the way the application interprets IPv6 addresses, which may allow attackers to exploit this weakness for malicious purposes.
How To Fix
Minimum fixed version
149-6.el10_1.alma.3
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating is not immediately possible, consider restricting access to the affected service or implementing network-level controls to mitigate potential exploitation until the patch can be applied.
Conclusion
The osbuild-composer service has a critical vulnerability related to the parsing of IPv6 host literals, which could lead to significant security risks. It is crucial to update to the patched version to mitigate these risks. Temporary workarounds can be employed until the update is applied. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for osbuild-composer →
FAQ
CVE-2026-25679 is a security vulnerability in osbuild-composer that involves incorrect parsing of IPv6 host literals, potentially leading to unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not feasible, consider implementing network-level controls or restricting access to the affected services as a temporary workaround.
Failing to address this vulnerability could expose your system to unauthorized access and manipulation of network requests, compromising data integrity and security.
For more details about the security issue, including its impact and acknowledgments, refer to the CVE page associated with CVE-2026-25679.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
