Red Hat Security Advisory: osbuild-composer security update
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
The Container Network Interface (CNI) project and related Red Hat products are affected by denial of service vulnerabilities in the Go crypto/tls and crypto/x509 libraries. Specifically, CVE-2026-32283 allows denial of service via multiple TLS 1.3 key update messages, and CVE-2026-32280 involves denial of service in certificate chain building. These vulnerabilities impact network connectivity components in Linux containers and container image inspection tools such as skopeo. Red Hat has released security updates addressing these issues across multiple products and architectures.
Potential Impact
Successful exploitation of these vulnerabilities could cause denial of service conditions in affected components, potentially disrupting container network connectivity or image inspection operations. There are no known exploits in the wild. The impact is rated as high by Red Hat Product Security.
Mitigation Recommendations
Red Hat has released official security updates that fix these vulnerabilities. Users should apply the relevant patches as described in the Red Hat advisories RHSA-2026:16101 and RHSA-2026:20609. Details and update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation is required beyond applying these official fixes.
Red Hat Security Advisory: osbuild-composer security update
Description
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Container Network Interface (CNI) project and related Red Hat products are affected by denial of service vulnerabilities in the Go crypto/tls and crypto/x509 libraries. Specifically, CVE-2026-32283 allows denial of service via multiple TLS 1.3 key update messages, and CVE-2026-32280 involves denial of service in certificate chain building. These vulnerabilities impact network connectivity components in Linux containers and container image inspection tools such as skopeo. Red Hat has released security updates addressing these issues across multiple products and architectures.
Potential Impact
Successful exploitation of these vulnerabilities could cause denial of service conditions in affected components, potentially disrupting container network connectivity or image inspection operations. There are no known exploits in the wild. The impact is rated as high by Red Hat Product Security.
Mitigation Recommendations
Red Hat has released official security updates that fix these vulnerabilities. Users should apply the relevant patches as described in the Red Hat advisories RHSA-2026:16101 and RHSA-2026:20609. Details and update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation is required beyond applying these official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:20608
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-32283"]
- State
- PUBLISHED
Threat ID: 6a16097ee29bf47b5064a9c0
Added to database: 05/26/2026, 20:58:38 UTC
Last enriched: 08/15/2026, 00:06:01 UTC
Last updated: 09/14/2026, 22:01:33 UTC
Views: 129
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.