The osbuild-composer service in Red Hat Enterprise Linux 8.6, which builds customized OS artifacts and supports image uploads to cloud, is affected by two security vulnerabilities. CVE-2025-61729 is a denial of service vulnerability in the crypto/x509 golang package caused by crafted certificates leading to excessive resource consumption. CVE-2025-61726 is a memory exhaustion vulnerability in golang's net/url package during query parameter parsing. Both issues can be exploited to degrade service availability by exhausting system resources. Red Hat has released updated osbuild-composer packages to fix these vulnerabilities in version 8.6 of Red Hat Enterprise Linux and its variants. The advisory references fixes in osbuild-composer-46.3-6.el8_6 packages and related components.

Successful exploitation of these vulnerabilities could cause denial of service conditions by exhausting CPU or memory resources on affected systems running osbuild-composer. This may lead to service disruption or degraded performance. There is no indication of remote code execution or data compromise from the provided information. No known exploits in the wild have been reported at this time.

Red Hat has released updated osbuild-composer packages for Red Hat Enterprise Linux 8.6 and its variants that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:5853 and the referenced article https://access.redhat.com/articles/11258. Applying this update will remediate the denial of service and memory exhaustion issues. No additional mitigations are specified or required beyond applying the official update.