Red Hat Security Advisory: osbuild-composer security, bug fix, and enhancement update
Description
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) Bug Fix(es) and Enhancement(s): * backport: osbuild-composer from el10 ships el9 google repos (JIRA:RHEL-127068) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory addresses multiple vulnerabilities in the osbuild-composer service, which builds customized OS artifacts such as VM images and OSTree commits. The security fixes include a certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810), several denial of service vulnerabilities via pathological or maliciously crafted inputs in Go libraries (net/mail, mime, OpenTelemetry-Go, encoding/asn1, net/url, net/http, crypto/tls, encoding/xml), and a cross-site scripting vulnerability in html/template (CVE-2026-56858). These vulnerabilities stem from flaws in Go's standard libraries and related dependencies used by osbuild-composer. The advisory confirms that patches are available and provides references for applying updates. Affected products include Red Hat Enterprise Linux 10 and associated builds on multiple architectures.
Potential Impact
The vulnerabilities fixed in this advisory could allow attackers to bypass certificate validation, cause denial of service conditions through crafted inputs or malformed data, and perform cross-site scripting attacks in contexts using the affected Go libraries. These issues impact the security and stability of systems running osbuild-composer and related Red Hat Enterprise Linux 10 components. The overall severity is high due to the potential for service disruption and security bypasses.
Mitigation Recommendations
Red Hat has released patches addressing these vulnerabilities. Users should apply the provided updates to osbuild-composer and related packages as detailed in the Red Hat advisory RHSA-2026:57126. No additional mitigation steps are required beyond applying the official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:57126
- Cve Count
- 1
- State
- PUBLISHED
Threat ID: 6a870a76acd9273b49b58b10
Added to database: 08/20/2026, 14:08:54 UTC
Last enriched: 09/30/2026, 16:16:01 UTC
Last updated: 10/04/2026, 21:09:32 UTC
Views: 83
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.