The osbuild-composer service in Red Hat Enterprise Linux 10.0 Extended Update Support is affected by four security vulnerabilities. CVE-2026-25679 involves incorrect parsing of IPv6 host literals in the net/url package. CVE-2026-32282 is a flaw in golang's internal syscall/unix package where Root.Chmod can follow symlinks outside the root directory. CVE-2026-32283 and CVE-2026-32280 are denial of service vulnerabilities in Go's crypto/tls and crypto/x509 packages related to TLS 1.3 key update messages and certificate chain building, respectively. Red Hat has released updated osbuild-composer packages that fix these issues. The advisory applies to multiple architectures including x86_64, s390x, ppc64le, and aarch64 for RHEL 10.0 EUS.

These vulnerabilities could lead to incorrect handling of network addresses, potential privilege escalation or unauthorized file system access via symlink traversal, and denial of service conditions in TLS communications and certificate validation processes. The advisory classifies the overall security impact as Important, indicating a high risk to affected systems if unpatched.

Red Hat has released updated osbuild-composer packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the provided patches.