The osbuild-composer service in Red Hat Enterprise Linux 9.6 Extended Update Support has two security vulnerabilities. CVE-2025-68121 concerns an unexpected session resumption issue in the crypto/tls package that causes incorrect certificate validation during TLS session resumption. CVE-2026-25679 involves incorrect parsing of IPv6 host literals in the net/url package. These vulnerabilities could affect the security of TLS connections and URL parsing within the osbuild-composer service, which builds and uploads OS images. Red Hat has released updated packages to address these issues.

The vulnerabilities impact the security of TLS session resumption and URL parsing in osbuild-composer, potentially leading to incorrect certificate validation and improper handling of IPv6 addresses. This could undermine the security guarantees of TLS connections and URL processing in the affected service. The advisory classifies the impact as Important, indicating a significant security concern but does not provide evidence of active exploitation in the wild.

Red Hat has released security updates for osbuild-composer in Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. Users should apply these official updates as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate the vulnerabilities. Since a fix is available, applying the update is the recommended mitigation. No additional vendor guidance indicates that no action is required or that the issue is already mitigated.