The osbuild-composer service in Red Hat Enterprise Linux 9.6 Extended Update Support is affected by two security vulnerabilities. CVE-2025-68121 is a flaw in the crypto/tls package causing incorrect certificate validation during TLS session resumption, potentially allowing unexpected session resumption. CVE-2026-25679 is an issue in the net/url package where IPv6 host literals are parsed incorrectly. These vulnerabilities have been addressed in the updated osbuild-composer packages provided by Red Hat. The advisory references the Red Hat Security Advisory RHSA-2026:19475 for further details and patch information.

The vulnerabilities impact the security of TLS session resumption and URL parsing within the osbuild-composer service, which could affect the integrity and security of OS artifact building and image uploading processes. Incorrect TLS session resumption validation may expose the service to potential man-in-the-middle or session hijacking risks. Incorrect IPv6 parsing could lead to improper handling of network addresses, potentially causing security or operational issues. Red Hat rates the overall security impact as Important.

Red Hat has released updated osbuild-composer packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.6 Extended Update Support and related variants should apply the provided security update as detailed in Red Hat Advisory RHSA-2026:19475. The advisory includes instructions on how to obtain and install the fixed packages. No additional mitigation steps are indicated beyond applying the official update.