Red Hat Product Errata RHSA-2026:61245 - Security Advisory Issued: 2026-08-31 Updated: 2026-08-31 RHSA-2026:61245 - Security Advisory Overview Updated Packages Synopsis Important: osbuild-composer security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) golang.org/x/net/idna: golang: net/ http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux Server - AUS 9.2 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 s390x Fixes BZ - 2449833 - CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation BZ - 2480756 - CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVEs CVE-2026-33186 CVE-2026-39821 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux Server - AUS 9.2 SRPM osbuild-composer-76.1-7.el9_2.src.rpm SHA-256: ebceeef31a4ce81c8b3d423f359a1f1e0c5f8b02b0a91fc87db56792c797a508 x86_64 osbuild-composer-76.1-7.el9_2.x86_64.rpm SHA-256: 6fcdd05060b7ddd25efd0406553457b366e7e29ad47a5ca0bc64e0bbf44c1b1c osbuild-composer-core-76.1-7.el9_2.x86_64.rpm SHA-256: 986885c9008aec486cf74de40834904085e3078d26467fa02287dfbbe7724d23 osbuild-composer-core-debuginfo-76.1-7.el9_2.x86_64.rpm SHA-256: 1cea7fdf8e359f28b2e83872040d14f9cb5c06f58bb68e61db1aa78219a1cfeb osbuild-composer-debuginfo-76.1-7.el9_2.x86_64.rpm SHA-256: 6e86739d3175b85364a068a4f48dd8287e2469d7f83e1c408b8a4c0535b5bea0 osbuild-composer-debugsource-76.1-7.el9_2.x86_64.rpm SHA-256: 4e48737f6667a3797416e0a5e5f8acd433df64d0dbc00fdb738f38593caaa806 osbuild-composer-dnf-json-76.1-7.el9_2.x86_64.rpm SHA-256: 281a98813d816bab87735d0cbf284d5fe6abe6574a45a16f2b6526dc935cd184 osbuild-composer-tests-debuginfo-76.1-7.el9_2.x86_64.rpm SHA-256: 528d9311ea2263c6f30d48d5cb33d0f468436e4d3f93dfc3c2f4bd492f3fa01b osbuild-composer-worker-76.1-7.el9_2.x86_64.rpm SHA-256: fbd761cde5d00434d6d84a9b9cf529721b988bf59282b17b9004f404d3f3ca7e osbuild-composer-worker-debuginfo-76.1-7.el9_2.x86_64.rpm SHA-256: ed7f84d03b8ffe9d1b72e247ff8436dc6f5c079c9c86324c9d58ba5f6879b50f Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 SRPM osbuild-composer-76.1-7.el9_2.src.rpm SHA-256: ebceeef31a4ce81c8b3d423f359a1f1e0c5f8b02b0a91fc87db56792c797a508 ppc64le osbuild-composer-76.1-7.el9_2.ppc64le.rpm SHA-256: f771d7b6d3534226330e2faa31def727f1e1bfdd22e135b1e2a21e1321dac015 osbuild-composer-core-76.1-7.el9_2.ppc64le.rpm SHA-256: 7fc22b1b528a6511d740d2bf5446259b4af659ce590c249ae2348e0d0dc5c816 osbuild-composer-core-debuginfo-76.1-7.el9_2.ppc64le.rpm SHA-256: c92a9340df1bd483ef94d47fe0768598aa883446830c955a24b8ecca8f082d37 osbuild-composer-debuginfo-76.1-7.el9_2.ppc64le.rpm SHA-256: 6358194f736d5577af22c5016be100ca2a5ec506102bc3e7e4aa579e77808396 osbuild-composer-debugsource-76.1-7.el9_2.ppc64le.rpm SHA-256: d761ae89a9a501a419d51662805a0135eec630ef168d37df6ac771a51276c8ce osbuild-composer-dnf-json-76.1-7.el9_2.ppc64le.rpm SHA-256: ef9f06f195c646cc0fe7af75cb649f048acce6b9ead36ccaf6d38129c6840727 osbuild-composer-tests-debuginfo-76.1-7.el9_2.ppc64le.rpm SHA-256: c5fb895835748d2c538c75857d7a23bb919d65c15073df0b202aff80049d26ef osbuild-composer-worker-76.1-7.el9_2.ppc64le.rpm SHA-256: e62167b155db9a24a71420273f6ed6e3730645c15581f9a68fdb0d472e21caff osbuild-composer-worker-debuginfo-76.1-7.el9_2.ppc64le.rpm SHA-256: ae5fb588fe409dc404368bed44464fe785571a8391ce42d69ec0b4cb5a856c47 Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 SRPM osbuild-composer-76.1-7.el9_2.src.rpm SHA-256: ebceeef31a4ce81c8b3d423f359a1f1e0c5f8b02b0a91fc87db56792c797a508 x86_64 osbuild-composer-76.1-7.el9_2.x86_64.rpm SHA-256: 6fcdd05060b7ddd25efd0406553457b366e7e29ad47a5ca0bc64e0bbf44c1b1c osbuild-composer-core-76.1-7.el9_2.x86_64.rpm SHA-256: 986885c9008aec486cf74de40834904085e3078d26467fa02287dfbbe7724d23 osbuild-composer-core-debuginfo-76.1-7.el9_2.x86_64.rpm SHA-256: 1cea7fdf8e359f28b2e83872040d14f9cb5c06f58bb68e61db1aa78219a1cfeb osbuild-composer-debuginfo-76.1-7.el9_2.x86_64.rpm SHA-256: 6e86739d3175b85364a068a4f48dd8287e2469d7f83e1c408b8a4c0535b5bea0 osbuild-composer-debugsource-76.1-7.el9_2.x86_64.rpm SHA-256: 4e48737f6667a3797416e0a5e5f8acd433df64d0dbc00fdb738f38593caaa806 osbuild-composer-dnf-json-76.1-7.el9_2.x86_64.rpm SHA-256: 281a98813d816bab87735d0cbf284d5fe6abe6574a45a16f2b6526dc935cd184 osbuild-composer-tests-debuginfo-76.1-7.el9_2.x86_64.rpm SHA-256: 528d9311ea2263c6f30d48d5cb33d0f468436e4d3f93dfc3c2f4bd492f3fa01b osbuild-composer-worker-76.1-7.el9_2.x86_64.rpm SHA-256: fbd761cde5d00434d6d84a9b9cf529721b988bf59282b17b9004f404d3f3ca7e osbuild-composer-worker-debuginfo-76.1-7.el9_2.x86_64.rpm SHA-256: ed7f84d03b8ffe9d1b72e247ff8436dc6f5c079c9c86324c9d58ba5f6879b50f Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 SRPM osbuild-composer-76.1-7.el9_2.src.rpm SHA-256: ebceeef31a4ce81c8b3d423f359a1f1e0c5f8b02b0a91fc87db56792c797a508 aarch64 osbuild-composer-76.1-7.el9_2.aarch64.rpm SHA-256: 0c6fc47f9332907781781637c8272b5aa79bfdd160fbe43f2b9785780262e4de osbuild-composer-core-76.1-7.el9_2.aarch64.rpm SHA-256: b914d732b0a7709ecbbb2005da7067cad56b68bc958585916f6d9afe41994019 osbuild-composer-core-debuginfo-76.1-7.el9_2.aarch64.rpm SHA-256: 2fec56ced330ba4459c155a83ce3d749dabf5ccff1fb595bb6e03dfe1bd96013 osbuild-composer-debuginfo-76.1-7.el9_2.aarch64.rpm SHA-256: 4f518e2f3a49823359571994948d1926361a7e4225454cbf9526dd77de132728 osbuild-composer-debugsource-76.1-7.el9_2.aarch64.rpm SHA-256: 4f87bb6e2a1ba513e34828499c789e89cfea7c619b2cc8a6a8ba7971d34b3206 osbuild-composer-dnf-json-76.1-7.el9_2.aarch64.rpm SHA-256: 333e90927f3b9ccef99910428b7bc968bd41537ec3870f6af3237e4b5b67863c osbuild-composer-tests-debuginfo-76.1-7.el9_2.aarch64.rpm SHA-256: bec5862a4564187f27ebac3e6a5ba063770315173763f73d773bbdc81236e458 osbuild-composer-worker-76.1-7.el9_2.aarch64.rpm SHA-256: 70aa84145f08caee3f0b26669aac03887582e7ee676e35f43f978472ce0bc99a osbuild-composer-worker-debuginfo-76.1-7.el9_2.aarch64.rpm SHA-256: 7c9167cb9ab57e501a1db3d47893982bcf1d9044b2e40fefa9a2910ef04d4f15 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 SRPM osbuild-composer-76.1-7.el9_2.src.rpm SHA-256: ebceeef31a4ce81c8b3d423f359a1f1e0c5f8b02b0a91fc87db56792c797a508 s390x osbuild-composer-76.1-7.el9_2.s390x.rpm SHA-256: 9d318ff6556eeeccc63ceb7d904d9154f93d8c5fe35ed131ab09819921d9a916 osbuild-composer-core-76.1-7.el9_2.s390x.rpm SHA-256: c5286c27a75f1f7b48452f010a3019f65ab98d2fa090be245c3133ef5e60f56f osbuild-composer-core-debuginfo-76.1-7.el9_2.s390x.rpm SHA-256: 78a39c8dbb2ab3b89ef1e0f8bde43e43b46799d5946ac46b344c71cc5874de0d osbuild-composer-debuginfo-76.1-7.el9_2.s390x.rpm SHA-256: ed3cae6abb2b02224a498895bc4960a24cba2eb4a63759ae095db528c332a5a9 osbuild-composer-debugsource-76.1-7.el9_2.s390x.rpm SHA-256: 60d864f2865361ccd11fc4b688ff3954d55b71027a6157b7e594079b138a0e90 osbuild-composer-dnf-json-76.1-7.el9_2.s390x.rpm SHA-256: 9dee15e2afcc56e573bb55be635cd96cf35454fcf5f4447d2bf27467faf6574d osbuild-composer-tests-debuginfo-76.1-7.el9_2.s390x.rpm SHA-256: dbbbcc389570df985388dfa9880ad50c719e5ce9c12e951e2c630b63979a6f99 osbuild-composer-worker-76.1-7.el9_2.s390x.rpm SHA-256: 1d7eb61b6a868c6be6b961269e3a0c5a1b56550ccca5a6f962600d50de11b7a9 osbuild-composer-worker-debuginfo-76.1-7.el9_2.s390x.rpm SHA-256: 0be5d63ae2c88d9d5b9bb31be00a73882c6ba77b7e1bde0b099b755238204255 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 SRPM osbuild-composer-76.1-7.el9_2.src.rpm SHA-256: ebceeef31a4ce81c8b3d423f359a1f1e0c5f8b02b0a91fc87db56792c797a508 x86_64 osbuild-composer-76.1-7.el9_2.x86_64.rpm SHA-256: 6fcdd05060b7ddd25efd0406553457b366e7e29ad47a5ca0bc64e0bbf44c1b1c osbuild-composer-core-76.1-7.el9_2.x86_64.rpm SHA-256: 986885c9008aec486cf74de40834904085e3078d26467fa02287dfbbe7724d23 osbuild-composer-core-debuginfo-76.1-7.el9_2.x86_64.rpm SHA-256: