BlackTreeLifecycle intelligence
Evidence-linked product lifecycle intelligenceSUPPORT · SECURITY · RETIREMENT
← Lifecycle catalogue
SECURITY ADVISORYRED HATVERIFIED

PUBLISHER UPDATE · RHSA-2026-69293

RHSA-2026-69293 release notes and known issues

Red Hat Security Advisory: osbuild-composer security update

Scope: Red Hat Enterprise Linux. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

An update for osbuild-composer is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178) * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

  • Red Hat Enterprise Linux

Affected versions

  • Red Hat Enterprise Linux AppStream (v. 9)
  • osbuild-composer-0:165.1-5.el9_8.x86_64
  • osbuild-composer-core-0:165.1-5.el9_8.x86_64
  • osbuild-composer-worker-0:165.1-5.el9_8.x86_64
  • osbuild-composer-debugsource-0:165.1-5.el9_8.x86_64
  • osbuild-composer-core-debuginfo-0:165.1-5.el9_8.x86_64
  • osbuild-composer-debuginfo-0:165.1-5.el9_8.x86_64
  • osbuild-composer-tests-debuginfo-0:165.1-5.el9_8.x86_64
  • osbuild-composer-worker-debuginfo-0:165.1-5.el9_8.x86_64
  • osbuild-composer-0:165.1-5.el9_8.src
  • osbuild-composer-0:165.1-5.el9_8.aarch64
  • osbuild-composer-core-0:165.1-5.el9_8.aarch64
  • osbuild-composer-worker-0:165.1-5.el9_8.aarch64
  • osbuild-composer-debugsource-0:165.1-5.el9_8.aarch64
  • osbuild-composer-core-debuginfo-0:165.1-5.el9_8.aarch64
  • osbuild-composer-debuginfo-0:165.1-5.el9_8.aarch64
  • osbuild-composer-tests-debuginfo-0:165.1-5.el9_8.aarch64
  • osbuild-composer-worker-debuginfo-0:165.1-5.el9_8.aarch64
  • osbuild-composer-0:165.1-5.el9_8.ppc64le
  • osbuild-composer-core-0:165.1-5.el9_8.ppc64le
  • osbuild-composer-worker-0:165.1-5.el9_8.ppc64le
  • osbuild-composer-debugsource-0:165.1-5.el9_8.ppc64le
  • osbuild-composer-core-debuginfo-0:165.1-5.el9_8.ppc64le
  • osbuild-composer-debuginfo-0:165.1-5.el9_8.ppc64le
  • osbuild-composer-tests-debuginfo-0:165.1-5.el9_8.ppc64le
  • osbuild-composer-worker-debuginfo-0:165.1-5.el9_8.ppc64le
  • osbuild-composer-0:165.1-5.el9_8.s390x
  • osbuild-composer-core-0:165.1-5.el9_8.s390x
  • osbuild-composer-worker-0:165.1-5.el9_8.s390x
  • osbuild-composer-debugsource-0:165.1-5.el9_8.s390x
  • osbuild-composer-core-debuginfo-0:165.1-5.el9_8.s390x
  • osbuild-composer-debuginfo-0:165.1-5.el9_8.s390x
  • osbuild-composer-tests-debuginfo-0:165.1-5.el9_8.s390x
  • osbuild-composer-worker-debuginfo-0:165.1-5.el9_8.s390x

Fixed versions or updates

  • No fixed version is stated in this record.

Recommended action

Apply the Red Hat updates listed in the official advisory.

Related vulnerabilities

BlackTree CVE Intelligence
CVE-2026-25681Open CVE report →CVE-2026-27136Open CVE report →CVE-2026-41178Open CVE report →CVE-2026-42502Open CVE report →CVE-2026-55677Open CVE report →

Official publisher evidence

RED HATVERIFIED

Red Hat Security Advisory: osbuild-composer security update

Checked 28 Sep 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source