Red Hat Product Errata RHSA-2026:59562 - Security Advisory Issued: 2026-08-25 Updated: 2026-08-25 RHSA-2026:59562 - Security Advisory Overview Updated Packages Synopsis Important: osbuild-composer security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): golang.org/x/net/idna: golang: net/ http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.4 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x Fixes BZ - 2480756 - CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing BZ - 2480757 - CVE-2026-27136 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass BZ - 2480761 - CVE-2026-25681 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting BZ - 2480762 - CVE-2026-42502 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVEs CVE-2026-25681 CVE-2026-27136 CVE-2026-39821 CVE-2026-42502 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.4 SRPM osbuild-composer-101.3-4.el9_4.5.src.rpm SHA-256: 8c069ce954d611a59dc0c4857ebb96d0bc49820e0f03c7a4dee21642bc84e57b x86_64 osbuild-composer-101.3-4.el9_4.5.x86_64.rpm SHA-256: 9f65259bf7ef2bb9e70e9933445ab8862df5005d9e811daeaf0c5820026be91d osbuild-composer-core-101.3-4.el9_4.5.x86_64.rpm SHA-256: a6c3d6ec410e6fb815ec84a54454ab01aa3ea986190a73e92ecd6ac491bc273d osbuild-composer-core-debuginfo-101.3-4.el9_4.5.x86_64.rpm SHA-256: c8060e588977a0f5359ec8a9c6b546dbad78400915c8a34df20810428ea9afdf osbuild-composer-debuginfo-101.3-4.el9_4.5.x86_64.rpm SHA-256: 881b4f4ceffbea922fe2fcca0a588874b3524ccad8c2bc16e2a6953aa50d9ff8 osbuild-composer-debugsource-101.3-4.el9_4.5.x86_64.rpm SHA-256: 5c314e61e772b9bd26a60bf3691f06f02e02f81f14e3ae13e2787d9e50864cdb osbuild-composer-tests-debuginfo-101.3-4.el9_4.5.x86_64.rpm SHA-256: 5891e13569e5744fa9125d77dea89a769b0e375e1d373d09b1d9ca7d31d4093f osbuild-composer-worker-101.3-4.el9_4.5.x86_64.rpm SHA-256: a345b3d35dbd259661250db40a9760dc85b12411e77502d80e51bac43aabd65f osbuild-composer-worker-debuginfo-101.3-4.el9_4.5.x86_64.rpm SHA-256: 3b0081b608d132a5adec53d4886d0fa2b5767f2e255c556465ba913c5d9feace Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 SRPM osbuild-composer-101.3-4.el9_4.5.src.rpm SHA-256: 8c069ce954d611a59dc0c4857ebb96d0bc49820e0f03c7a4dee21642bc84e57b ppc64le osbuild-composer-101.3-4.el9_4.5.ppc64le.rpm SHA-256: 6e246e995952cad347ae477a1f79a4096540767b377a3e27eada1cdac5184d3a osbuild-composer-core-101.3-4.el9_4.5.ppc64le.rpm SHA-256: 0d25e1a877a03d99761e1672d7cb1bdd0cdc143f623d204bdfbf9857ef2fcd81 osbuild-composer-core-debuginfo-101.3-4.el9_4.5.ppc64le.rpm SHA-256: 9703d2eb701a9cc8b8be568c5428b74a770ae7a1a6ccbeeca6eee2a05d61054e osbuild-composer-debuginfo-101.3-4.el9_4.5.ppc64le.rpm SHA-256: b962277c8683bc3cdaae4904f536156dce4bae0a232665d55885f46d3b98f622 osbuild-composer-debugsource-101.3-4.el9_4.5.ppc64le.rpm SHA-256: fe057f07c6ee817f95a955955139efbe1514cf433181ec59df3258ac8ce8bbe0 osbuild-composer-tests-debuginfo-101.3-4.el9_4.5.ppc64le.rpm SHA-256: 6029f6d1e7bf665c6ceeaa95cd0f90a325e39d82792d01d01da614746fd0ebe2 osbuild-composer-worker-101.3-4.el9_4.5.ppc64le.rpm SHA-256: 52c72d2c4b875ffa7adae11f1853f26c29d27806d5467f74c81744d885576166 osbuild-composer-worker-debuginfo-101.3-4.el9_4.5.ppc64le.rpm SHA-256: e389ef62eefeb65873963f5ffe3def5419b2b43f31aea3c3457327c0707562cc Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 SRPM osbuild-composer-101.3-4.el9_4.5.src.rpm SHA-256: 8c069ce954d611a59dc0c4857ebb96d0bc49820e0f03c7a4dee21642bc84e57b x86_64 osbuild-composer-101.3-4.el9_4.5.x86_64.rpm SHA-256: 9f65259bf7ef2bb9e70e9933445ab8862df5005d9e811daeaf0c5820026be91d osbuild-composer-core-101.3-4.el9_4.5.x86_64.rpm SHA-256: a6c3d6ec410e6fb815ec84a54454ab01aa3ea986190a73e92ecd6ac491bc273d osbuild-composer-core-debuginfo-101.3-4.el9_4.5.x86_64.rpm SHA-256: c8060e588977a0f5359ec8a9c6b546dbad78400915c8a34df20810428ea9afdf osbuild-composer-debuginfo-101.3-4.el9_4.5.x86_64.rpm SHA-256: 881b4f4ceffbea922fe2fcca0a588874b3524ccad8c2bc16e2a6953aa50d9ff8 osbuild-composer-debugsource-101.3-4.el9_4.5.x86_64.rpm SHA-256: 5c314e61e772b9bd26a60bf3691f06f02e02f81f14e3ae13e2787d9e50864cdb osbuild-composer-tests-debuginfo-101.3-4.el9_4.5.x86_64.rpm SHA-256: 5891e13569e5744fa9125d77dea89a769b0e375e1d373d09b1d9ca7d31d4093f osbuild-composer-worker-101.3-4.el9_4.5.x86_64.rpm SHA-256: a345b3d35dbd259661250db40a9760dc85b12411e77502d80e51bac43aabd65f osbuild-composer-worker-debuginfo-101.3-4.el9_4.5.x86_64.rpm SHA-256: 3b0081b608d132a5adec53d4886d0fa2b5767f2e255c556465ba913c5d9feace Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 SRPM osbuild-composer-101.3-4.el9_4.5.src.rpm SHA-256: 8c069ce954d611a59dc0c4857ebb96d0bc49820e0f03c7a4dee21642bc84e57b aarch64 osbuild-composer-101.3-4.el9_4.5.aarch64.rpm SHA-256: 15b0bd3738fd2e8d8bdc44581c912c9dc75652d54aa1d79fad9e6db905b0bed5 osbuild-composer-core-101.3-4.el9_4.5.aarch64.rpm SHA-256: 6768db314f4433ccfbf0dbc5ec1846e69e2fcb2b7d494ad668a673c31f8d07d5 osbuild-composer-core-debuginfo-101.3-4.el9_4.5.aarch64.rpm SHA-256: 003a588c987cb377efb4156205a9b054ef9d29378cba9f4bb3253e7fa5980910 osbuild-composer-debuginfo-101.3-4.el9_4.5.aarch64.rpm SHA-256: 225d825dd4e93afdbe040314ba8dac4f66a5b0f1a99c5d2bf7564d84b9bbf6a5 osbuild-composer-debugsource-101.3-4.el9_4.5.aarch64.rpm SHA-256: faa43ab5311b0dbfe77e1b7f8503759efbaec1945760a921dee9d2af94680712 osbuild-composer-tests-debuginfo-101.3-4.el9_4.5.aarch64.rpm SHA-256: 976d327f0df9f58db9d2c98b3b449e15436b8e4f8b71df030f053ea85c4e17de osbuild-composer-worker-101.3-4.el9_4.5.aarch64.rpm SHA-256: 8ae0131aa7c61b446a7f2e167e4f08d78fc54ad7fd47d6f1aff978a24e228da5 osbuild-composer-worker-debuginfo-101.3-4.el9_4.5.aarch64.rpm SHA-256: 510676abf010f7008133ab377b1b5217cd1a95b6996a50b1b412d90fe8d45d2d Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 SRPM osbuild-composer-101.3-4.el9_4.5.src.rpm SHA-256: 8c069ce954d611a59dc0c4857ebb96d0bc49820e0f03c7a4dee21642bc84e57b s390x osbuild-composer-101.3-4.el9_4.5.s390x.rpm SHA-256: 619ac6bc11f6b43c77b37c5555262110d154a9ebf2b2d740a5d24fcbd9f07fec osbuild-composer-core-101.3-4.el9_4.5.s390x.rpm SHA-256: 19cf596920e2852af415d8cae17c5c72c12010d7dd2a0b038f4530b91bc70c8c osbuild-composer-core-debuginfo-101.3-4.el9_4.5.s390x.rpm SHA-256: c23dbd14c3cc2664ec1c719f0c219181e6cf204f2b36b332462d55c240612606 osbuild-composer-debuginfo-101.3-4.el9_4.5.s390x.rpm SHA-256: 92edd4fc5fdf687731a53c87af5f9223975e382e107d45dfcbe91598f0b865d8 osbuild-composer-debugsource-101.3-4.el9_4.5.s390x.rpm SHA-256: e74d5f8c168f7e67f6bcaf23224e53f6378f1964f9618981e4c441068f681109 osbuild-composer-tests-debuginfo-101.3-4.el9_4.5.s390x.rpm SHA-256: 3abcc89223424b60a9396db411fb43cdeb04019db05912a7dd4f2ad9edd8239d osbuild-composer-worker-101.3-4.el9_4.5.s390x.rpm SHA-256: 915a069b29d5b457857b57db004cc69d65023636871bd386547241a69801ffd0 osbuild-composer-worker-debuginfo-101.3-4.el9_4.5.s390x.rpm SHA-256: 87a17b96c613db76da52d0aca362b69686530be92484e6fda5dbad6b50f2afc2 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 SRPM osbuild-composer-101.3-4.el9_4.5.src.rpm SHA-256: 8c069ce954d611a59dc0c4857ebb96d0bc49820e0f03c7a4dee21642bc84e57b x86_64 osbuild-composer-101.3-4.el9_4.5.x86_64.rpm SHA-256: 9f65259bf7ef2bb9e70e9933445ab8862df5005d9e811daeaf0c5820026be91d osbuild-composer-core-101.3-4.el9_4.5.x86_64.rpm SHA-256: a6c3d6ec410e6fb815ec84a54454ab01aa3ea986190a73e92ecd6ac491bc273d osbuild-composer-core-debuginfo-101.3-4.el9_4.5.x86_64.rpm SHA-256: c8