A critical security update for Red Hat Enterprise Linux 10's `image-builder` addresses multiple vulnerabilities in its underlying Go components, including Cross-Site Scripting (XSS) flaws in `golang.org/x/net/html` and a Denial of Service (DoS) vulnerability in OpenTelemetry baggage headers. The CVSS 3.1 base score for the XSS vulnerabilities (CVE-2026-27136, CVE-2026-25681, CVE-2026-42502) is 6.1 (Medium). The affected component versions are `golang net` library versions prior to 0.55.0, which must be updated to that fixed version.
Red Hat Product Errata RHSA-2026:67139 - Security Advisory Issued: 2026-09-14 Updated: 2026-09-14 RHSA-2026:67139 - Security Advisory Overview Updated Packages Synopsis Important: image-builder security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for image-builder is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fix(es): golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2480757 - CVE-2026-27136 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass BZ - 2480761 - CVE-2026-25681 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting BZ - 2480762 - CVE-2026-42502 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering BZ - 2484830 - CVE-2026-41178 github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVEs CVE-2026-25681 CVE-2026-27136 CVE-2026-41178 CVE-2026-42502 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM image-builder-52.1-2.el10_2.src.rpm SHA-256: 86a7d8b384ecc36a47d1af23e94fb085418bb7929e6f307be947a5cf25174695 x86_64 image-builder-52.1-2.el10_2.x86_64.rpm SHA-256: a2462f4666ef57c92c33241f3317f45de3eacd11f377906895b58076df290eef image-builder-debuginfo-52.1-2.el10_2.x86_64.rpm SHA-256: d1ac428201b45e88e3ce227fd81aea1319181a30c66d4c60771b1dd6561e6a2a image-builder-debugsource-52.1-2.el10_2.x86_64.rpm SHA-256: ebbb86e648124c3086d2aea87c55abae057568b1a652dbf9dbe1fe3ac810ef63 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 SRPM image-builder-52.1-2.el10_2.src.rpm SHA-256: 86a7d8b384ecc36a47d1af23e94fb085418bb7929e6f307be947a5cf25174695 x86_64 image-builder-52.1-2.el10_2.x86_64.rpm SHA-256: a2462f4666ef57c92c33241f3317f45de3eacd11f377906895b58076df290eef image-builder-debuginfo-52.1-2.el10_2.x86_64.rpm SHA-256: d1ac428201b45e88e3ce227fd81aea1319181a30c66d4c60771b1dd6561e6a2a image-builder-debugsource-52.1-2.el10_2.x86_64.rpm SHA-256: ebbb86e648124c3086d2aea87c55abae057568b1a652dbf9dbe1fe3ac810ef63 Red Hat Enterprise Linux for IBM z Systems 10 SRPM image-builder-52.1-2.el10_2.src.rpm SHA-256: 86a7d8b384ecc36a47d1af23e94fb085418bb7929e6f307be947a5cf25174695 s390x image-builder-52.1-2.el10_2.s390x.rpm SHA-256: 358be97049d5befcab0af1b17938dd4b2dba7123e21689f83346ec95e9b35a94 image-builder-debuginfo-52.1-2.el10_2.s390x.rpm SHA-256: caec60e316e76e22cc9cc8ac3d6f7067af5ce6dad236861e30642860db6cef4b image-builder-debugsource-52.1-2.el10_2.s390x.rpm SHA-256: 9f7e9601b9ed82d6b09b2df2ce220e5056b63758ceb761588b02cb9c4ae20b15 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 SRPM image-builder-52.1-2.el10_2.src.rpm SHA-256: 86a7d8b384ecc36a47d1af23e94fb085418bb7929e6f307be947a5cf25174695 s390x image-builder-52.1-2.el10_2.s390x.rpm SHA-256: 358be97049d5befcab0af1b17938dd4b2dba7123e21689f83346ec95e9b35a94 image-builder-debuginfo-52.1-2.el10_2.s390x.rpm SHA-256: caec60e316e76e22cc9cc8ac3d6f7067af5ce6dad236861e30642860db6cef4b image-builder-debugsource-52.1-2.el10_2.s390x.rpm SHA-256: 9f7e9601b9ed82d6b09b2df2ce220e5056b63758ceb761588b02cb9c4ae20b15 Red Hat Enterprise Linux for Power, little endian 10 SRPM image-builder-52.1-2.el10_2.src.rpm SHA-256: 86a7d8b384ecc36a47d1af23e94fb085418bb7929e6f307be947a5cf25174695 ppc64le image-builder-52.1-2.el10_2.ppc64le.rpm SHA-256: 69209f853deacead25bdd1292e74c75c77849957adb7481634c341df92b4f6f3 image-builder-debuginfo-52.1-2.el10_2.ppc64le.rpm SHA-256: 6318dd57432120b873de617d24d9739e3a3163c4dac27ab48c80ee2ca24d170a image-builder-debugsource-52.1-2.el10_2.ppc64le.rpm SHA-256: 2a201296e1efb4ee56ddebac59fd795244ea36edaac2b41ac2f210c9aac955e6 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 SRPM image-builder-52.1-2.el10_2.src.rpm SHA-256: 86a7d8b384ecc36a47d1af23e94fb085418bb7929e6f307be947a5cf25174695 ppc64le image-builder-52.1-2.el10_2.ppc64le.rpm SHA-256: 69209f853deacead25bdd1292e74c75c77849957adb7481634c341df92b4f6f3 image-builder-debuginfo-52.1-2.el10_2.ppc64le.rpm SHA-256: 6318dd57432120b873de617d24d9739e3a3163c4dac27ab48c80ee2ca24d170a image-builder-debugsource-52.1-2.el10_2.ppc64le.rpm SHA-256: 2a201296e1efb4ee56ddebac59fd795244ea36edaac2b41ac2f210c9aac955e6 Red Hat Enterprise Linux for ARM 64 10 SRPM image-builder-52.1-2.el10_2.src.rpm SHA-256: 86a7d8b384ecc36a47d1af23e94fb085418bb7929e6f307be947a5cf25174695 aarch64 image-builder-52.1-2.el10_2.aarch64.rpm SHA-256: 4a7bcaeabe01fb9e15ea495cf05e7ef91ccc0a45698c220e0d15394331884a28 image-builder-debuginfo-52.1-2.el10_2.aarch64.rpm SHA-256: 465a2cc6dbd2f02f54e5a034de9aece448df74c4ff1928d457c345f1f9b577e5 image-builder-debugsource-52.1-2.el10_2.aarch64.rpm SHA-256: 157d2c8fd98f0215b47bc35685b32da98699b4c189170e94d6f7b4b83a1dbf35 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 SRPM image-builder-52.1-2.el10_2.src.rpm SHA-256: 86a7d8b384ecc36a47d1af23e94fb085418bb7929e6f307be947a5cf25174695 aarch64 image-builder-52.1-2.el10_2.aarch64.rpm SHA-256: 4a7bcaeabe01fb9e15ea495cf05e7ef91ccc0a45698c220e0d15394331884a28 image-builder-debuginfo-52.1-2.el10_2.aarch64.rpm SHA-256: 465a2cc6dbd2f02f54e5a034de9aece448df74c4ff1928d457c345f1f9b577e5 image-builder-debugsource-52.1-2.el10_2.aarch64.rpm SHA-256: 157d2c8fd98f0215b47bc35685b32da98699b4c189170e94d6f7b4b83a1dbf35 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 SRPM image-builder-52.1-2.el10_2.src.rpm SHA-256: 86a7d8b384ecc36a47d1af23e94fb085418bb7929e6f307be947a5cf25174695 aarch64 image-builder-52.1-2.el10_2.aarch64.rpm SHA-256: 4a7bcaeabe01fb9e15ea495cf05e7ef91ccc0a45698c220e0d15394331884a28 image-builder-debuginfo-52.1-2.el10_2.aarch64.rpm SHA-256: 465a2cc6dbd2f02f54e5a034de9aece448df74c4ff1928d457c345f1f9b577e5 image-builder-debugsource-52.1-2.el10_2.aarch64.rpm SHA-256: 157d2c8fd98f0215b47bc35685b32da98699b4c189170e94d6f7b4b83a1dbf35 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 SRPM image-builder-52.1-2.el10_2.src.rpm SHA-256: 86a7d8b384ecc36a47d1af23e94fb085418bb7929e6f307be947a5cf25174695 s390x image-builder-52.1-2.el10_2.s390x.rpm SHA-256: 358be97049d5befcab0af1b17938dd4b2dba7123e21689f83346ec95e9b35a94 image-builder-debuginfo-52.1-2.el10_2.s390x.rpm SHA-256: caec60e316e76e22cc9cc8ac3d6f7067af5ce6dad236861e30642860db6cef4b image-builder-debugsource-52.1-2.el10_2.s390x.rpm SHA-256: 9f7e9601b9ed82d6b09b2df2ce220e5056b63758ceb761588b02cb9c4ae20b15 Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 SRPM image-builder-52.1-2.el10_2.src.rpm SHA-256: 86a7d8b384ecc36a47d1af23e94fb085418bb7929e6f307be947a5cf25174695 ppc64le image-builder-52.1-2.el10_2.ppc64le.rpm SHA-256: 69209f853deacead25bdd1292e74c75c77849957adb7481634c341df92b4f6f3 image-builder-debuginfo-52.1-2.el10_2.ppc64le.rpm SHA-256: 6318dd57432120b873de617d24d9739e3a3163c4dac27ab48c80ee2ca24d170a image-builder-debugsource-52.1-2.el10_2.ppc64le.rpm SHA-256: 2a201296e1efb4ee56ddebac59fd795244ea36edaac2b41ac2f210c9aac955e6 Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 SRPM image-builder-52.1-2.el10_2.src.rpm SHA-256: 86a7d8b384ecc36a47d1af23e94fb085418bb7929e6f307be947a5cf25174695 x86_64 image-builder-52.1-2.el10_2.x86_64.rpm SHA-256