Red Hat Security Advisory: osbuild-composer security update
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
The Red Hat security advisory RHSA-2026:19750 addresses four vulnerabilities in the osbuild-composer service for Red Hat Enterprise Linux 10.0 Extended Update Support. CVE-2026-25679 involves incorrect parsing of IPv6 host literals in the net/url package. CVE-2026-32282 concerns a flaw in golang's internal syscall unix Root.Chmod function that can follow symlinks outside the root directory. CVE-2026-32283 and CVE-2026-32280 are denial of service vulnerabilities in Go's crypto/tls and crypto/x509 packages, respectively, related to TLS 1.3 key update messages and certificate chain building. The advisory includes updated osbuild-composer packages for multiple architectures to fix these issues.
Potential Impact
These vulnerabilities could lead to incorrect handling of IPv6 addresses, potential unauthorized file permission changes via symlink traversal, and denial of service conditions in TLS operations. The advisory classifies the overall impact as Important, indicating a high security risk that could affect system stability and security when using osbuild-composer on affected Red Hat Enterprise Linux 10.0 versions.
Mitigation Recommendations
Red Hat has released updated osbuild-composer packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply the provided security updates as detailed in the Red Hat advisory RHSA-2026:19750 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.
Red Hat Security Advisory: osbuild-composer security update
Description
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Red Hat security advisory RHSA-2026:19750 addresses four vulnerabilities in the osbuild-composer service for Red Hat Enterprise Linux 10.0 Extended Update Support. CVE-2026-25679 involves incorrect parsing of IPv6 host literals in the net/url package. CVE-2026-32282 concerns a flaw in golang's internal syscall unix Root.Chmod function that can follow symlinks outside the root directory. CVE-2026-32283 and CVE-2026-32280 are denial of service vulnerabilities in Go's crypto/tls and crypto/x509 packages, respectively, related to TLS 1.3 key update messages and certificate chain building. The advisory includes updated osbuild-composer packages for multiple architectures to fix these issues.
Potential Impact
These vulnerabilities could lead to incorrect handling of IPv6 addresses, potential unauthorized file permission changes via symlink traversal, and denial of service conditions in TLS operations. The advisory classifies the overall impact as Important, indicating a high security risk that could affect system stability and security when using osbuild-composer on affected Red Hat Enterprise Linux 10.0 versions.
Mitigation Recommendations
Red Hat has released updated osbuild-composer packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply the provided security updates as detailed in the Red Hat advisory RHSA-2026:19750 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:19750
- Cve Count
- 4
- Additional Cves
- ["CVE-2026-32280","CVE-2026-32282","CVE-2026-32283"]
- State
- PUBLISHED
Threat ID: 6a160975e29bf47b5063eff3
Added to database: 05/26/2026, 20:58:29 UTC
Last enriched: 08/14/2026, 22:44:37 UTC
Last updated: 09/14/2026, 00:46:50 UTC
Views: 64
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.