Red Hat Product Errata RHSA-2026:59560 - Security Advisory Issued: 2026-08-25 Updated: 2026-08-25 RHSA-2026:59560 - Security Advisory Overview Updated Packages Synopsis Important: osbuild-composer security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64 Red Hat Enterprise Linux Server - AUS 9.6 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x Fixes BZ - 2480757 - CVE-2026-27136 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass BZ - 2480761 - CVE-2026-25681 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting BZ - 2480762 - CVE-2026-42502 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVEs CVE-2026-25681 CVE-2026-27136 CVE-2026-42502 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 SRPM osbuild-composer-132.2-11.el9_6.src.rpm SHA-256: 7ec7f4f18b5c8c982693d59a41c1ce0c20dc1ed3242233a4309ac40ba1552089 x86_64 osbuild-composer-132.2-11.el9_6.x86_64.rpm SHA-256: fec26ac310aa140a2590b4d515fa8e6bd3bce751c1865134d5f034895b674a9f osbuild-composer-core-132.2-11.el9_6.x86_64.rpm SHA-256: 293fff357f775e047e9e0fc81bc9494dbc2e0686b5b0d8769a9ac26378726a69 osbuild-composer-core-debuginfo-132.2-11.el9_6.x86_64.rpm SHA-256: 48fe6fe2759fdb4db41a7d324342a79d82f6f4a8dcef38c5801d50e371a1644b osbuild-composer-debuginfo-132.2-11.el9_6.x86_64.rpm SHA-256: 5a133bfb5d73230c22b79396541364c3b1daa379756d811e4703ee4d5a375729 osbuild-composer-debugsource-132.2-11.el9_6.x86_64.rpm SHA-256: 44c9c1842be78162d06a852189ca8e6be9f45912fb674e7e485eb5b1271884bd osbuild-composer-tests-debuginfo-132.2-11.el9_6.x86_64.rpm SHA-256: b9e253fa31dcf070b709c27601391c7d36cdf623002fabcf735e1860e2c82f77 osbuild-composer-worker-132.2-11.el9_6.x86_64.rpm SHA-256: 7cbd2353bca6ef46e41b57dfd01dd3b62835cafcd9f09089bbced1d026e7610d osbuild-composer-worker-debuginfo-132.2-11.el9_6.x86_64.rpm SHA-256: 03d1b888d9d693e33bcaccaab13438c5df32e114efa9ce9dda31de6dc8a525a8 Red Hat Enterprise Linux Server - AUS 9.6 SRPM osbuild-composer-132.2-11.el9_6.src.rpm SHA-256: 7ec7f4f18b5c8c982693d59a41c1ce0c20dc1ed3242233a4309ac40ba1552089 x86_64 osbuild-composer-132.2-11.el9_6.x86_64.rpm SHA-256: fec26ac310aa140a2590b4d515fa8e6bd3bce751c1865134d5f034895b674a9f osbuild-composer-core-132.2-11.el9_6.x86_64.rpm SHA-256: 293fff357f775e047e9e0fc81bc9494dbc2e0686b5b0d8769a9ac26378726a69 osbuild-composer-core-debuginfo-132.2-11.el9_6.x86_64.rpm SHA-256: 48fe6fe2759fdb4db41a7d324342a79d82f6f4a8dcef38c5801d50e371a1644b osbuild-composer-debuginfo-132.2-11.el9_6.x86_64.rpm SHA-256: 5a133bfb5d73230c22b79396541364c3b1daa379756d811e4703ee4d5a375729 osbuild-composer-debugsource-132.2-11.el9_6.x86_64.rpm SHA-256: 44c9c1842be78162d06a852189ca8e6be9f45912fb674e7e485eb5b1271884bd osbuild-composer-tests-debuginfo-132.2-11.el9_6.x86_64.rpm SHA-256: b9e253fa31dcf070b709c27601391c7d36cdf623002fabcf735e1860e2c82f77 osbuild-composer-worker-132.2-11.el9_6.x86_64.rpm SHA-256: 7cbd2353bca6ef46e41b57dfd01dd3b62835cafcd9f09089bbced1d026e7610d osbuild-composer-worker-debuginfo-132.2-11.el9_6.x86_64.rpm SHA-256: 03d1b888d9d693e33bcaccaab13438c5df32e114efa9ce9dda31de6dc8a525a8 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 SRPM osbuild-composer-132.2-11.el9_6.src.rpm SHA-256: 7ec7f4f18b5c8c982693d59a41c1ce0c20dc1ed3242233a4309ac40ba1552089 s390x osbuild-composer-132.2-11.el9_6.s390x.rpm SHA-256: f1c42786b66eb7b9c9d2632983dee0e468698b0aeb5e426b8c9182921a75c465 osbuild-composer-core-132.2-11.el9_6.s390x.rpm SHA-256: 0708121b194e2eecea0edf91bba7ac7b32a63dfdd1ca4899bcd2871a14dce468 osbuild-composer-core-debuginfo-132.2-11.el9_6.s390x.rpm SHA-256: 081da322f670a976503aed29cacbdd1f049be0646134b3c7466fee2d730c7405 osbuild-composer-debuginfo-132.2-11.el9_6.s390x.rpm SHA-256: f06ac2d7e7efc004c5327346024360acb1c3fcce19baa91cba8b593e2fd1e983 osbuild-composer-debugsource-132.2-11.el9_6.s390x.rpm SHA-256: 30c639fd9cd4be3e926b04c724a5e4c23ca97b0ecd5c5d2f48e7d2b042c3e8cc osbuild-composer-tests-debuginfo-132.2-11.el9_6.s390x.rpm SHA-256: e5dc17a05a9e232dc8d37dffc7488dce32354730d1dd94d6d90b97187e5d889d osbuild-composer-worker-132.2-11.el9_6.s390x.rpm SHA-256: 51c042b253556f44605fca04dc03ac3fb4c90bba6e21e36c14dd2ff39e5ef54e osbuild-composer-worker-debuginfo-132.2-11.el9_6.s390x.rpm SHA-256: 70ddf48117ac1dae56282c3550891fbade55c9d6c50e8d1113ba10a1c042f2b2 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 SRPM osbuild-composer-132.2-11.el9_6.src.rpm SHA-256: 7ec7f4f18b5c8c982693d59a41c1ce0c20dc1ed3242233a4309ac40ba1552089 ppc64le osbuild-composer-132.2-11.el9_6.ppc64le.rpm SHA-256: 242ac5cf1f0852e3a25d3ac013cd0af42273802fb9dfecdba568089301a7011f osbuild-composer-core-132.2-11.el9_6.ppc64le.rpm SHA-256: 29ec2355b69f2e53404a4deeaadf94aa84fdf6e66f30401c4d250045c41c38bf osbuild-composer-core-debuginfo-132.2-11.el9_6.ppc64le.rpm SHA-256: e6f6967ec4eeb58f9d19801272e8082a95852338b7fa726d5fec473c48daec98 osbuild-composer-debuginfo-132.2-11.el9_6.ppc64le.rpm SHA-256: 3e2214458e37b77661dfe27fe44fa99d39c01222e5ea44753f14f403559f2f17 osbuild-composer-debugsource-132.2-11.el9_6.ppc64le.rpm SHA-256: 0239a1ccb4941d92a071e38d60e6654d0c7f1eb61a5500424eb40c54a8a25b57 osbuild-composer-tests-debuginfo-132.2-11.el9_6.ppc64le.rpm SHA-256: 4ccf82c8e6b2a2119489e128300604fdc4dd1f5b18c0d610b7168c57937efd33 osbuild-composer-worker-132.2-11.el9_6.ppc64le.rpm SHA-256: d877d4e26bbb065cafb6d538c70bd19e6ce1b14c85b5ec8b84a0bbf4e6c6ba2e osbuild-composer-worker-debuginfo-132.2-11.el9_6.ppc64le.rpm SHA-256: 05adb0f2cfb5cd1000fc3fb61bea45f0b89752e598f570c8e88eceafbfee63d5 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 SRPM osbuild-composer-132.2-11.el9_6.src.rpm SHA-256: 7ec7f4f18b5c8c982693d59a41c1ce0c20dc1ed3242233a4309ac40ba1552089 aarch64 osbuild-composer-132.2-11.el9_6.aarch64.rpm SHA-256: 3178eda7f44fd85548312889ee9bd2373b2d927a092d5074b79951a00a03699b osbuild-composer-core-132.2-11.el9_6.aarch64.rpm SHA-256: 8ba54a521968ef3c391a6ab5de7eb0a75cf72f8940415ec919a5e0f1138f256d osbuild-composer-core-debuginfo-132.2-11.el9_6.aarch64.rpm SHA-256: c329d6f8bef7553fdd8c144097e12ad4eb883436076369417af48e01bd0b2f48 osbuild-composer-debuginfo-132.2-11.el9_6.aarch64.rpm SHA-256: 26f6a96ff664afa6f9a73b280c7d665ba47559023be81b9426fa34d5095ba504 osbuild-composer-debugsource-132.2-11.el9_6.aarch64.rpm SHA-256: e7d23aa0ca8eae24c9659344e7872e6709d6ff99a9568b7828236c176f124db6 osbuild-composer-tests-debuginfo-132.2-11.el9_6.aarch64.rpm SHA-256: aef263b298ff640c614d05ba098ded69202d03ca35eaa0553cbcab7acd9f3546 osbuild-composer-worker-132.2-11.el9_6.aarch64.rpm SHA-256: a3bf7245504476a10d470e5bb3b1b33ca7294a983766d3a086a80086d8128206 osbuild-composer-worker-debuginfo-132.2-11.el9_6.aarch64.rpm SHA-256: a9a9a12b6e0f3a4dd0a09dd18350543e4cbc605fd4113b7cef983bedd3a322e4 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 SRPM osbuild-composer-132.2-11.el9_6.src.rpm SHA-256: 7ec7f4f18b5c8c982693d59a41c1ce0c20dc1ed3242233a4309ac40ba1552089 ppc64le osbuild-composer-132.2-11.el9_6.ppc64le.rpm SHA-256: 242ac5cf1f0852e3a25d3ac013cd0af42273802fb9dfecdba568089301a7011f osbuild-composer-core-132.2-11.el9_6.ppc64le.rpm SHA-256: 29ec2355b69f2e53404a4deeaadf94aa84fdf6e66f30401c4d250045c41c38bf osbuild-composer-core-debuginfo-132.2-11.el9_6.ppc64le.rpm SHA-256: e6f6967ec4eeb58f9d19801272e8082a958523