Red Hat Product Errata RHSA-2026:67148 - Security Advisory Issued: 2026-09-14 Updated: 2026-09-14 RHSA-2026:67148 - Security Advisory Overview Updated Packages Synopsis Important: osbuild-composer security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for osbuild-composer is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866) crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2344219 - CVE-2025-22866 crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec BZ - 2456333 - CVE-2026-32281 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation BZ - 2467809 - CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing BZ - 2484204 - CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header BZ - 2484830 - CVE-2026-41178 github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers BZ - 2493622 - CVE-2026-55677 github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy CVEs CVE-2025-22866 CVE-2026-32281 CVE-2026-41178 CVE-2026-42499 CVE-2026-42504 CVE-2026-55677 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM osbuild-composer-101.5-3.el8_10.src.rpm SHA-256: 3ce6833de9fdc96f2a758b770ef188e70324c7fa0ff40cac47bea223ec7c99f5 x86_64 osbuild-composer-101.5-3.el8_10.x86_64.rpm SHA-256: b81d562a27128ad3548e1a1aec3fbfd7ab9b2299675efe987c8110c55c9274c0 osbuild-composer-core-101.5-3.el8_10.x86_64.rpm SHA-256: b8b3ba01bac5ac725b5a703b9cd7f337b57cdbe9d3ddb24d35882609c68ce3c3 osbuild-composer-core-debuginfo-101.5-3.el8_10.x86_64.rpm SHA-256: 20db8a8a276416f3e21152a518be01d604bf7662742d2a679d7d1c18d6ee6c37 osbuild-composer-debuginfo-101.5-3.el8_10.x86_64.rpm SHA-256: c3e8656354f6b10b12a252a02dc575b3939d5b1f4b3ac02c1b78bf4f99876588 osbuild-composer-debugsource-101.5-3.el8_10.x86_64.rpm SHA-256: 429831dd662c0169c74b47559f76bfa90dbf1e3e46e01f51b544f9be2906a9dc osbuild-composer-tests-debuginfo-101.5-3.el8_10.x86_64.rpm SHA-256: a72c16f7fe072f6abf4ff5f0366c75a556a476531d4fce688a74bb21af79aea4 osbuild-composer-worker-101.5-3.el8_10.x86_64.rpm SHA-256: a67d4bfda35ce1366382929ec21fdd9030f3d5c760f760bb9cbcb74bc40f2205 osbuild-composer-worker-debuginfo-101.5-3.el8_10.x86_64.rpm SHA-256: bdb394e9765a564fe83e8c790c6b1e130ab6983062d861c5e062edb048826bdc Red Hat Enterprise Linux for IBM z Systems 8 SRPM osbuild-composer-101.5-3.el8_10.src.rpm SHA-256: 3ce6833de9fdc96f2a758b770ef188e70324c7fa0ff40cac47bea223ec7c99f5 s390x osbuild-composer-101.5-3.el8_10.s390x.rpm SHA-256: e185659e0d19e8f197a9c646219826ba62de2c0313ea378143e8703478dd70ea osbuild-composer-core-101.5-3.el8_10.s390x.rpm SHA-256: 4fde5b28501e3acab4d827ddf4550674bdb05b9ec8d70c4e0245e2d5d2621eee osbuild-composer-core-debuginfo-101.5-3.el8_10.s390x.rpm SHA-256: f8267389f2642f13d86463b52f062b9bfdd7698527c729445336f159270bfb1f osbuild-composer-debuginfo-101.5-3.el8_10.s390x.rpm SHA-256: 1dfbd59c48a69a0e04594eb71b0a1182cdf27944e03cf7617756f1276f925d2b osbuild-composer-debugsource-101.5-3.el8_10.s390x.rpm SHA-256: 1ce837794e197c8108404c8af4566555a1baf724047752d30b8598ac539b3b98 osbuild-composer-tests-debuginfo-101.5-3.el8_10.s390x.rpm SHA-256: ef02d8a8e999eee6d16521223fb0d1cd8ffdbab0c1efe1284fc3e667c8d5380b osbuild-composer-worker-101.5-3.el8_10.s390x.rpm SHA-256: f80a0386c667c081e36c7e54f517fd31da31942d26fa625c5e3f4a8a12f49e01 osbuild-composer-worker-debuginfo-101.5-3.el8_10.s390x.rpm SHA-256: 924c9e9c81528e6a3ddae2584a951a7ba12c4c3043b9f84828a03a9e05b95a77 Red Hat Enterprise Linux for Power, little endian 8 SRPM osbuild-composer-101.5-3.el8_10.src.rpm SHA-256: 3ce6833de9fdc96f2a758b770ef188e70324c7fa0ff40cac47bea223ec7c99f5 ppc64le osbuild-composer-101.5-3.el8_10.ppc64le.rpm SHA-256: 7b984ca05ef4048b87b7b2e4a1713504f17d1f2af90ba8feed80932472f005a6 osbuild-composer-core-101.5-3.el8_10.ppc64le.rpm SHA-256: 39e9170802ac8acc3c89cb6c0966c7eee43364b97c6b41e11c92634b3622e9f3 osbuild-composer-core-debuginfo-101.5-3.el8_10.ppc64le.rpm SHA-256: 96d5d6af3f005d22c649642bcb83d8cc19bc4c1a0310a222c84756ea8a4f6e34 osbuild-composer-debuginfo-101.5-3.el8_10.ppc64le.rpm SHA-256: 55718efc97ac8b4767dbf8bcc9137d4f7606b0c458e10ca157afcb69d2df2891 osbuild-composer-debugsource-101.5-3.el8_10.ppc64le.rpm SHA-256: db7482dbf78751dfc54dac50cb08723471c7020938564f46a7943d1cd4c1203e osbuild-composer-tests-debuginfo-101.5-3.el8_10.ppc64le.rpm SHA-256: f4edee20b8508989740e41c4538503d99834bf2ade76232900bbea08fcabd656 osbuild-composer-worker-101.5-3.el8_10.ppc64le.rpm SHA-256: 066d139405eb6c9d60517ccaedfb6e2063c1db909c48d3e36c074d40a6c197b6 osbuild-composer-worker-debuginfo-101.5-3.el8_10.ppc64le.rpm SHA-256: 265e527cd6aab09ffb9e7fff4b56d2ab58636ac82e2b8a77fd8c15e385a58ed4 Red Hat Enterprise Linux for ARM 64 8 SRPM osbuild-composer-101.5-3.el8_10.src.rpm SHA-256: 3ce6833de9fdc96f2a758b770ef188e70324c7fa0ff40cac47bea223ec7c99f5 aarch64 osbuild-composer-101.5-3.el8_10.aarch64.rpm SHA-256: 3155280a6fb63a156418d84c4737ac8a7c09edb8d42e46f4d8a657e5b0b44351 osbuild-composer-core-101.5-3.el8_10.aarch64.rpm SHA-256: b65b4ce49c5192b3b3ce62a1d399f6d7b200bf0eb407b77079c86c23096a2cfe osbuild-composer-core-debuginfo-101.5-3.el8_10.aarch64.rpm SHA-256: 022dc331ebc0db5275d75f93e219abef0fa90cad93c34ae54ac147439f504f49 osbuild-composer-debuginfo-101.5-3.el8_10.aarch64.rpm SHA-256: 5193e1adf9cef23bbf65f474bc820e09aced54e065b8c9207bfeddcaf7f6519e osbuild-composer-debugsource-101.5-3.el8_10.aarch64.rpm SHA-256: 3aca52c8ea7171fb608cc41b2da63ddd5f9816017c2eb6f6e1a228b18d6bb24a osbuild-composer-tests-debuginfo-101.5-3.el8_10.aarch64.rpm SHA-256: c786b4fb499ea64cc151266c8334b300757ab701048290005bf3ec2855658044 osbuild-composer-worker-101.5-3.el8_10.aarch64.rpm SHA-256: acb33f8f6598fd163958ae2ffe4bfe63b0e1babbbd16099e8ee89b4f9a479594 osbuild-composer-worker-debuginfo-101.5-3.el8_10.aarch64.rpm SHA-256: 0eb2a627154a6d9b2fbf830d50d22b03502e98fd1dc53004b0172f1db144e4b5 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 SRPM osbuild-composer-101.5-3.el8_10.src.rpm SHA-256: 3ce6833de9fdc96f2a758b770ef188e70324c7fa0ff40cac47bea223ec7c99f5 x86_64 osbuild-composer-101.5-3.el8_10.x86_64.rpm SHA-256: b81d562a27128ad3548e1a1aec3fbfd7ab9b2299675efe987c8110c55c9274c0 osbuild-composer-core-101.5-3.el8_10.x86_64.rpm SHA-256: b8b3ba01bac5ac725b5a703b9cd7f337b57cdbe9d3ddb24d35882609c68ce3c3 osbuild-composer-core-debuginfo-101.5-3.el8_10.x86_64.rpm SHA-256: 20db8a8a276416f3e21152a518be01d604bf7662742d2a679d7d1c18d6ee6c37 osbuild-composer-debuginfo-101.5-3.el8_10.x86_64.rpm SHA-256: c3e8656354f6b10b12a252a02dc575b3939d5b1f4b3ac02c1b78bf4f99876588 osbuild-composer-debugsource-101.5-3.el8_10.x86_64.rpm SHA-256: 429831dd662c0169c74b47559f76bfa90dbf1e3e46e01f51b544f9be2906a9dc osbuild-composer-tests-debuginfo-101.5-3.el8_10.x86_64.rpm SHA-256: a72c16f7fe072f6abf4ff5f0366c75a556a476531d4fce688a74bb21af79aea4 osbuild-composer-worker-101.5-3.el8_10.x86_64.rpm SHA-256: a67d4bfda35ce1366382929ec21fdd9030f3d5c760f760bb9cbcb74bc40f2205 osbuild-composer-worker-debuginfo-101.5-3.el8_10.x86_64.rpm SHA-256: bdb394e9765a564fe83e8c790c6b1e130ab6983062d861c5e062edb048826bdc Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 SRPM osbuild-composer-101.5-3.el8_10.src.rpm SHA-256: 3ce6833de9fdc96f2a758b770ef188e70324c7fa0ff40cac47bea223ec7c99f5 aarch64 osbuild-composer-101.5-3.el8_10.aarch64.rpm SHA-256: 3155280a6fb63a156418d84c4737ac8a7c09e