This security update for osbuild-composer addresses multiple vulnerabilities in its underlying Go runtime, including a critical (CVSS 10.0) TLS certificate validation flaw during session resumption (CVE-2025-68121) and several high-severity denial-of-service issues in crypto/x509 and net/url parsing. The vulnerabilities affect systems running osbuild-composer on RHEL 9.2 Update Services for SAP Solutions, stemming from Go versions prior to 1.24.13, 1.25.7-1.25.9, and 1.26.0-1.26.2 as specified in the NVD data. The fix is applied by updating the osbuild-composer packages via the referenced Red Hat advisory.
Red Hat Product Errata RHSA-2026:48036 - Security Advisory Issued: 2026-07-29 Updated: 2026-07-29 RHSA-2026:48036 - Security Advisory Overview Updated Packages Synopsis Important: osbuild-composer security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.2 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 s390x Fixes BZ - 2437111 - CVE-2025-68121 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption BZ - 2445356 - CVE-2026-25679 net/url: Incorrect parsing of IPv6 host literals in net/url BZ - 2456333 - CVE-2026-32281 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation BZ - 2456336 - CVE-2026-32282 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root BZ - 2456338 - CVE-2026-32283 crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages BZ - 2456339 - CVE-2026-32280 crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVEs CVE-2025-68121 CVE-2026-25679 CVE-2026-32280 CVE-2026-32281 CVE-2026-32282 CVE-2026-32283 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.2 SRPM osbuild-composer-76.1-6.el9_2.src.rpm SHA-256: 7e512e5b875a54cd15fcff497c18a6e26b6224af1c5397942845b4d30a302296 x86_64 osbuild-composer-76.1-6.el9_2.x86_64.rpm SHA-256: ea7e19a9c9365d80dd9b0e62114869fa79118dcc678ff58d9a0f4fdc59417c57 osbuild-composer-core-76.1-6.el9_2.x86_64.rpm SHA-256: 2bfc6a58639f77a6e3988db2c5820087f01e31aa4f4507542a0fa08aa07377de osbuild-composer-core-debuginfo-76.1-6.el9_2.x86_64.rpm SHA-256: 467de91de8e8c96c614ffbe41356e54ffebef4b7dff1e99f11aaa2f6473e013f osbuild-composer-debuginfo-76.1-6.el9_2.x86_64.rpm SHA-256: 4018c07e641763d6a473391fbd331b3b69d73ed95824f3854c3118b81a92f0de osbuild-composer-debugsource-76.1-6.el9_2.x86_64.rpm SHA-256: c825293df328ba8be0e997b351a6e419234f973fff9bc4ab4a19540d83b60b58 osbuild-composer-dnf-json-76.1-6.el9_2.x86_64.rpm SHA-256: 98de4738ff26b76ad48b308376dcf70ce9a05e7a18009c05df73ca6390f6f919 osbuild-composer-tests-debuginfo-76.1-6.el9_2.x86_64.rpm SHA-256: 235371b464ffe4a8e0ad0a0c22e337476a59ebc870b86b5cf1e302d9d6a55083 osbuild-composer-worker-76.1-6.el9_2.x86_64.rpm SHA-256: 5024a7ba958897aa5639909f440dc78b02d4da43e719450108285132c5720f15 osbuild-composer-worker-debuginfo-76.1-6.el9_2.x86_64.rpm SHA-256: 719fc6499ceb983cdfe0e776b07a48bbf74a5b7d8f275af33c2c4f3a0e7f8cb7 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 SRPM osbuild-composer-76.1-6.el9_2.src.rpm SHA-256: 7e512e5b875a54cd15fcff497c18a6e26b6224af1c5397942845b4d30a302296 ppc64le osbuild-composer-76.1-6.el9_2.ppc64le.rpm SHA-256: eff3e37037ca3f8a674124537c9485d1efacecb1aa877c7da454368810d19385 osbuild-composer-core-76.1-6.el9_2.ppc64le.rpm SHA-256: e4365cff9529cff47b8d013c620294f15ed52bffda8d2feb91b5ee65f3bf0000 osbuild-composer-core-debuginfo-76.1-6.el9_2.ppc64le.rpm SHA-256: 960d4a538d5a93dff8afc8352b66bc0d9fcbcd0d0322cf6adc8f9f92db7ad7c7 osbuild-composer-debuginfo-76.1-6.el9_2.ppc64le.rpm SHA-256: d35e69131f879a77b240ba737603668b770317c86743958260f678a7cd54ba36 osbuild-composer-debugsource-76.1-6.el9_2.ppc64le.rpm SHA-256: 359a0539495c2eda03b3d8eee11767cfde85ff8ff3836bab830193a2d4f6fb65 osbuild-composer-dnf-json-76.1-6.el9_2.ppc64le.rpm SHA-256: c336d3553acccb54ac8539322980ecde78e0978f913474d49c27e72a3c86f0fe osbuild-composer-tests-debuginfo-76.1-6.el9_2.ppc64le.rpm SHA-256: abf106024a7b259caa0bd19665c9da0bac337593450404c7810f4714a4e80106 osbuild-composer-worker-76.1-6.el9_2.ppc64le.rpm SHA-256: 81ded82eacfe98b9b90538fb2f855eb1462453c5cea426d59fc93f4b28e677ef osbuild-composer-worker-debuginfo-76.1-6.el9_2.ppc64le.rpm SHA-256: 448f8b507fdf63bb4a95a43d208b58e1ecb9dd4099472e74937a33cb44f49473 Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 SRPM osbuild-composer-76.1-6.el9_2.src.rpm SHA-256: 7e512e5b875a54cd15fcff497c18a6e26b6224af1c5397942845b4d30a302296 x86_64 osbuild-composer-76.1-6.el9_2.x86_64.rpm SHA-256: ea7e19a9c9365d80dd9b0e62114869fa79118dcc678ff58d9a0f4fdc59417c57 osbuild-composer-core-76.1-6.el9_2.x86_64.rpm SHA-256: 2bfc6a58639f77a6e3988db2c5820087f01e31aa4f4507542a0fa08aa07377de osbuild-composer-core-debuginfo-76.1-6.el9_2.x86_64.rpm SHA-256: 467de91de8e8c96c614ffbe41356e54ffebef4b7dff1e99f11aaa2f6473e013f osbuild-composer-debuginfo-76.1-6.el9_2.x86_64.rpm SHA-256: 4018c07e641763d6a473391fbd331b3b69d73ed95824f3854c3118b81a92f0de osbuild-composer-debugsource-76.1-6.el9_2.x86_64.rpm SHA-256: c825293df328ba8be0e997b351a6e419234f973fff9bc4ab4a19540d83b60b58 osbuild-composer-dnf-json-76.1-6.el9_2.x86_64.rpm SHA-256: 98de4738ff26b76ad48b308376dcf70ce9a05e7a18009c05df73ca6390f6f919 osbuild-composer-tests-debuginfo-76.1-6.el9_2.x86_64.rpm SHA-256: 235371b464ffe4a8e0ad0a0c22e337476a59ebc870b86b5cf1e302d9d6a55083 osbuild-composer-worker-76.1-6.el9_2.x86_64.rpm SHA-256: 5024a7ba958897aa5639909f440dc78b02d4da43e719450108285132c5720f15 osbuild-composer-worker-debuginfo-76.1-6.el9_2.x86_64.rpm SHA-256: 719fc6499ceb983cdfe0e776b07a48bbf74a5b7d8f275af33c2c4f3a0e7f8cb7 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 SRPM osbuild-composer-76.1-6.el9_2.src.rpm SHA-256: 7e512e5b875a54cd15fcff497c18a6e26b6224af1c5397942845b4d30a302296 aarch64 osbuild-composer-76.1-6.el9_2.aarch64.rpm SHA-256: 88a69f37fb7f63d8d93b761b563b67aadaee96a43be7e705f8b256cc024e761e osbuild-composer-core-76.1-6.el9_2.aarch64.rpm SHA-256: 67a41ad27d8d837c9109b50b7ec9f16b91b43629746d0caa5c7b48624562f309 osbuild-composer-core-debuginfo-76.1-6.el9_2.aarch64.rpm SHA-256: 379223d4acf6ac7e7c3fb701fef216230692c08754eb9a6c2c7faf4d4bfcbbcd osbuild-composer-debuginfo-76.1-6.el9_2.aarch64.rpm SHA-256: 9e286acd4d1e9a9198724be37fab6f10752f1deb1edd8206d099915cd51b0df3 osbuild-composer-debugsource-76.1-6.el9_2.aarch64.rpm SHA-256: 583b90a41a4dbeb468ece81e4db76972e55ee90b90f815bc85e57b92e426d142 osbuild-composer-dnf-json-76.1-6.el9_2.aarch64.rpm SHA-256: fd322a37b766ad17a38dfe7f1eb328339495bfb77231750d2df21ae038351923 osbuild-composer-tests-debuginfo-76.1-6.el9_2.aarch64.rpm SHA-256: 6421092a180e9c7e8280055979b7a80c4170b8d311e195203a8d246351748117 osbuild-composer-worker-76.1-6.el9_2.aarch64.rpm SHA-256: 03850332b2bb0ff3244cfe53625ce60e97e5b4ef992f279fbdc18125df3c008e osbuild-composer-worker-debuginfo-76.1-6.el9_2.aarch64.rpm SHA-256: d9d8f822eaadcfa9ef9c257cf5ce733d7825b9e312f5f7b6d2cfed2211f48a42 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 SRPM osbuild-composer-76.1-6.el9_2.src.rpm SHA-256: 7e512e5b875a54cd15fcff497c18a6e26b6224af1c5397942845b4d30a302296 s390x osbuild-composer-76.1-6.el9_2.s390x.rpm SHA-256: e3d8b051b0f5334b424fc5348065350c66dcd85367b975d9e02e72124026f6a2 osbuild-composer-core-76.1-6.el9_2.s390x.rpm SHA-256: 6ee7e2c17e3c5fbaf14c7c33f040ac38154768d3bc0bc57329bda56ba287ede6 osbuild-composer-core-debuginfo-76.1-6.el9_2.s390x.rpm SHA-256: 4feb808359646eb162130ec905052a8dc3f894e5c772345c0d4aa8a03045c16b osbuild-composer-debuginfo-76.1-6.el9_2.s390x.rpm SHA-256: efbd5a714003a6b06c936cc4339840b98c1f165a5f79bc1ff1c346de4c7ef4a5 osbuild-composer-debugsource-76.1-6.el9_2.s390x.rpm SHA-256: a8c894fef0a1144689b36f52d8548fff46c19c775ef356f65a424ccc8adb999a osbuild-composer-dnf-json-76.1-6.el9_2.s390x.rpm SHA-256: ee4687baee7eec1c104b6f57b2004a527772efaa7af5753795bcbf6c7caac718 osbuild-composer-tests-debuginfo-76.1-6.el9_2.s390x.rpm SHA-256: 567f44a15e9105c573638c6654b3c6bf286c5134e7ad657ae9f34d4baa271ce