Red Hat Product Errata RHSA-2026:32991 - Security Advisory Issued: 2026-06-29 Updated: 2026-06-29 RHSA-2026:32991 - Security Advisory Overview Updated Packages Synopsis Important: osbuild-composer security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.4 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x Fixes BZ - 2455470 - CVE-2026-34986 github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVEs CVE-2026-34986 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.4 SRPM osbuild-composer-101.3-4.el9_4.2.src.rpm SHA-256: bdeae6f07eca38744f90408e2b7704107b8e99205be5ba425a5247497ad8ba35 x86_64 osbuild-composer-101.3-4.el9_4.2.x86_64.rpm SHA-256: 7bacdd7ad3ed77df825912b5c84fbe4a74fefdfb00a44cc331b4ce68265d4d6b osbuild-composer-core-101.3-4.el9_4.2.x86_64.rpm SHA-256: 478f5a507d5d44265f27e07b0c5b6a25746d3611c68794743e4fd49c574a2a89 osbuild-composer-core-debuginfo-101.3-4.el9_4.2.x86_64.rpm SHA-256: 8027050a3482c9cfee3bae0310a3e1f6235ffa02f0d7372ba41b17f1f632b8bd osbuild-composer-debuginfo-101.3-4.el9_4.2.x86_64.rpm SHA-256: df3ee802710f09920f5a08c16c04fbcae0572f4735b0026fd93f204258573b2a osbuild-composer-debugsource-101.3-4.el9_4.2.x86_64.rpm SHA-256: a2c8ed3546a521c877caa7ba3b3e684057faf8c6ff69b20c58a6c17e19897412 osbuild-composer-tests-debuginfo-101.3-4.el9_4.2.x86_64.rpm SHA-256: 2392041294ce90fb4e4e4485d8b43d20cc0c9453eea49d1a7d84bfcab96e9533 osbuild-composer-worker-101.3-4.el9_4.2.x86_64.rpm SHA-256: c7cfe0149717120df2df4f505a324527a1c11b408beb3e7ca5ee909f5462d5f4 osbuild-composer-worker-debuginfo-101.3-4.el9_4.2.x86_64.rpm SHA-256: 75e98c1bff90ae992aa7e8302f7d52469c5d8aaa80183ea72f024ad745093e0e Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 SRPM osbuild-composer-101.3-4.el9_4.2.src.rpm SHA-256: bdeae6f07eca38744f90408e2b7704107b8e99205be5ba425a5247497ad8ba35 ppc64le osbuild-composer-101.3-4.el9_4.2.ppc64le.rpm SHA-256: d16113d0b65b1486e9c4d53217a005b80b9026b6fe50d04cb33fbcce48ea6472 osbuild-composer-core-101.3-4.el9_4.2.ppc64le.rpm SHA-256: ca2256b2835a4250c6a8e2a03c0be96b8356905cd18bce57ebb16c766b52eec9 osbuild-composer-core-debuginfo-101.3-4.el9_4.2.ppc64le.rpm SHA-256: 73456fdf0aaebd8c6a9208efb07ff8c114ba44aee4a2b59bddeee10e62bf308a osbuild-composer-debuginfo-101.3-4.el9_4.2.ppc64le.rpm SHA-256: baf96329a66447f1c22f1fc1f0ea397517800e50ac7c3ddbc83b7fa2ede033db osbuild-composer-debugsource-101.3-4.el9_4.2.ppc64le.rpm SHA-256: ee0d86dddab6507db5a022a90a222fd11a1772340f7b8157270004c3ae8cd59e osbuild-composer-tests-debuginfo-101.3-4.el9_4.2.ppc64le.rpm SHA-256: c3d34c42a2b99267449a9318c9a293855b7282d6a1c96829b123aa9103b54311 osbuild-composer-worker-101.3-4.el9_4.2.ppc64le.rpm SHA-256: 65cf034ff88e382f728cc14f210dda1fe561370d2f0743b97f314abee199a573 osbuild-composer-worker-debuginfo-101.3-4.el9_4.2.ppc64le.rpm SHA-256: 92814fa4614e487d86a88c819b08eac4edb57b9710e8f0a849e5a562333d444b Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 SRPM osbuild-composer-101.3-4.el9_4.2.src.rpm SHA-256: bdeae6f07eca38744f90408e2b7704107b8e99205be5ba425a5247497ad8ba35 x86_64 osbuild-composer-101.3-4.el9_4.2.x86_64.rpm SHA-256: 7bacdd7ad3ed77df825912b5c84fbe4a74fefdfb00a44cc331b4ce68265d4d6b osbuild-composer-core-101.3-4.el9_4.2.x86_64.rpm SHA-256: 478f5a507d5d44265f27e07b0c5b6a25746d3611c68794743e4fd49c574a2a89 osbuild-composer-core-debuginfo-101.3-4.el9_4.2.x86_64.rpm SHA-256: 8027050a3482c9cfee3bae0310a3e1f6235ffa02f0d7372ba41b17f1f632b8bd osbuild-composer-debuginfo-101.3-4.el9_4.2.x86_64.rpm SHA-256: df3ee802710f09920f5a08c16c04fbcae0572f4735b0026fd93f204258573b2a osbuild-composer-debugsource-101.3-4.el9_4.2.x86_64.rpm SHA-256: a2c8ed3546a521c877caa7ba3b3e684057faf8c6ff69b20c58a6c17e19897412 osbuild-composer-tests-debuginfo-101.3-4.el9_4.2.x86_64.rpm SHA-256: 2392041294ce90fb4e4e4485d8b43d20cc0c9453eea49d1a7d84bfcab96e9533 osbuild-composer-worker-101.3-4.el9_4.2.x86_64.rpm SHA-256: c7cfe0149717120df2df4f505a324527a1c11b408beb3e7ca5ee909f5462d5f4 osbuild-composer-worker-debuginfo-101.3-4.el9_4.2.x86_64.rpm SHA-256: 75e98c1bff90ae992aa7e8302f7d52469c5d8aaa80183ea72f024ad745093e0e Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 SRPM osbuild-composer-101.3-4.el9_4.2.src.rpm SHA-256: bdeae6f07eca38744f90408e2b7704107b8e99205be5ba425a5247497ad8ba35 aarch64 osbuild-composer-101.3-4.el9_4.2.aarch64.rpm SHA-256: db82961b552d49a34b09aabb385e668d59f71ebb6dc00abf14e96ec130f4a726 osbuild-composer-core-101.3-4.el9_4.2.aarch64.rpm SHA-256: c1561d936fa7f070ceda4bdb37fae02aea7e1eff5eee1b2f91464e3207710604 osbuild-composer-core-debuginfo-101.3-4.el9_4.2.aarch64.rpm SHA-256: 127a0b96c77d2d1da7a6c7646372a94ea044a86ad9fb005ab3d2ffcee2b71d39 osbuild-composer-debuginfo-101.3-4.el9_4.2.aarch64.rpm SHA-256: 28738383155ff9c8ce9cdcacbaacd8421019e036d04ed70d09d8c461ab962d78 osbuild-composer-debugsource-101.3-4.el9_4.2.aarch64.rpm SHA-256: f54d3ec9e1fa1b4b15f522d54e4ae731f8fdbc41a72457799b710bb1db57aaeb osbuild-composer-tests-debuginfo-101.3-4.el9_4.2.aarch64.rpm SHA-256: c3b72a2dae67834c97e5cf83c3dc0dd7acdedb5d3c5364eda2535e03ab974bb2 osbuild-composer-worker-101.3-4.el9_4.2.aarch64.rpm SHA-256: 0f22dad2c12e0f7b53db6cb9c7fc7d5d4ce3eb090fff1549f5987efddde99712 osbuild-composer-worker-debuginfo-101.3-4.el9_4.2.aarch64.rpm SHA-256: f4408d2d5512e0be9e899e6604ac28e48a887ddfbbd2b9097c196e682c6eaeb1 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 SRPM osbuild-composer-101.3-4.el9_4.2.src.rpm SHA-256: bdeae6f07eca38744f90408e2b7704107b8e99205be5ba425a5247497ad8ba35 s390x osbuild-composer-101.3-4.el9_4.2.s390x.rpm SHA-256: 8673b8e2e506e8ced57244ca045632e012b05d8f79a63afcef0e782823239472 osbuild-composer-core-101.3-4.el9_4.2.s390x.rpm SHA-256: fa41e07b8fab32f4f21165c67854a67a60d244a50349a69fe3f5ff18a07f8b6d osbuild-composer-core-debuginfo-101.3-4.el9_4.2.s390x.rpm SHA-256: 98a3ba08e62ef4b9d2f461e0a183004b5969ac5d36646ead712d957bc2a26ce5 osbuild-composer-debuginfo-101.3-4.el9_4.2.s390x.rpm SHA-256: 4c90013477fbede458427c6c229ee23baf56cffb45c39ffc6b77a0cf6d85832b osbuild-composer-debugsource-101.3-4.el9_4.2.s390x.rpm SHA-256: 99465d26929673ee6fe52c719acff00ef684d55399123a44f627b1dc7889306a osbuild-composer-tests-debuginfo-101.3-4.el9_4.2.s390x.rpm SHA-256: a54a8240183a4bb11bf59c5a079dcd481d1690d4e19b17bcb4045c28f1754cfe osbuild-composer-worker-101.3-4.el9_4.2.s390x.rpm SHA-256: a06c5a3174e42e1173ad79b437ff8575f06ee6cb21790fe88b24f18b92cc9e8a osbuild-composer-worker-debuginfo-101.3-4.el9_4.2.s390x.rpm SHA-256: 3078fc5a5149e92979fbf06519b2523c72a5347e921104e944c01bc72f8ac63c Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 SRPM osbuild-composer-101.3-4.el9_4.2.src.rpm SHA-256: bdeae6f07eca38744f90408e2b7704107b8e99205be5ba425a5247497ad8ba35 x86_64 osbuild-composer-101.3-4.el9_4.2.x86_64.rpm SHA-256: 7bacdd7ad3ed77df825912b5c84fbe4a74fefdfb00a44cc331b4ce68265d4d6b osbuild-composer-core-101.3-4.el9_4.2.x86_64.rpm SHA-256: 478f5a507d5d44265f27e07b0c5b6a25746d3611c68794743e4fd49c574a2a89 osbuild-composer-core-debuginfo-101.3-4.el9_4.2.x86_64.rpm SHA-256: 8027050a3482c9cfee3bae0310a3e1f6235ffa02f0d7372ba41b17f1f632b8bd osbuild-composer-debuginfo-101.3-4.el9_4.2.x86_64.rpm SHA-256: df3ee802710f09920f5a08c16c04fbcae0572f4735b0026fd93f204258573b2a osbuild-composer-debugsource-101.3-4.el9_4.2.x86_64.rpm SHA-256: a2c8ed3546a521c877caa7ba3b3e684057faf8c6ff69b20c58a6c17e19897412 osbuild-composer-tests-debuginfo-101.3-4.el9_4.2.x86_64.rpm SHA-256: 2392041294ce90fb4e4e4485d8b43d20cc0c9453eea49d1a7d84bfcab96e9533 osbuild-composer-worker-101.3-4.el9_4.2.x86_64.rpm SHA-256: c7cfe0149717120df2df4f505a324527a1c11b408beb3e7ca5ee909f5462d5f4 osbuild-composer-worker-debuginfo-101.3-4.el9_4.2.x86_64.rpm SHA-256: 75e98c1bff90ae992aa7e8302f7d52469c5d8aaa80183ea72f024ad745093e0e Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 SR