Critical Security Update for osbuild-composer: Addressing Multiple Vulnerabilities
Summary
RLSA-2026:3752: Important: osbuild-composer security update. Affects osbuild-composer versions < 0:149-5.el10_1.rocky.0.8. Fixed in 0:149-5.el10_1.rocky.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, such as virtual machine images and OSTree commits. It leverages osbuild for image creation and supports direct uploads to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators.
Vulnerability Detail
The vulnerabilities in osbuild-composer stem from various components of the Go programming language, which can lead to severe issues including Denial of Service (DoS) attacks and memory exhaustion. Specifically, CVE-2025-61729 allows for excessive resource consumption via crafted certificates, while CVE-2025-61728 causes high CPU usage during archive index building. Additionally, CVE-2025-61726 can lead to memory exhaustion during query parameter parsing, and CVE-2025-68121 introduces unexpected session resumption in TLS connections. These vulnerabilities can compromise the stability and security of applications relying on osbuild-composer.
How To Fix
Minimum fixed version
0:149-5.el10_1.rocky.0.8
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting the input size for certificates and query parameters to mitigate the risk of resource exhaustion. Additionally, monitor system resource usage closely when using osbuild-composer until the update is applied.
Conclusion
The vulnerabilities identified in osbuild-composer pose significant risks to system stability and security. It is crucial for users to update to the latest patched version to mitigate these risks effectively. Regular monitoring and proactive management of open-source dependencies are essential to maintain a secure environment.
See every vulnerability recorded for osbuild-composer →
FAQ
osbuild-composer is a service for building customized OS artifacts, enabling users to create VM images and OSTree commits efficiently.
The main vulnerabilities include excessive resource consumption, memory exhaustion, and unexpected session resumption in TLS connections.
You can update osbuild-composer by running 'sudo dnf update osbuild-composer' in your terminal.
The vulnerabilities have a CVSS score of 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
