# CVE-2025-22866: osbuild-composer: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood

CVE-2025-22866 is fixed in 23 products on 1 platform, first by RHSA-2025:7466, released February 6, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-22866
- Priority: High
- CVSS: 7.5 (Important)
- EPSS: 0.0029
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 6, 2025

## Description

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.  Security Fix(es):  * crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)  * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)  * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)  * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)  * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)  * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | delve RHEL 10 | 1.24.1-1.el10_0 | [RHSA-2025:7466](https://patchblox.com/security/data/fix/linux/rhsa-2025-7466.md) | Feb 6, 2025 |
| Linux | delve RHEL 9 | 0:1.24.1-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | delve almalinux 10 | 1.24.1-1.el10_0 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | delve ol 10 | 0:1.24.1-1.0.1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | delve rocky 10 | 0:1.24.1-1.el10_0 | [RLSA-2025:7466](https://patchblox.com/security/data/fix/linux/rlsa-2025-7466.md) | Oct 3, 2025 |
| Linux | delve rocky 9 | 0:1.24.1-2.el9_6 | [RLSA-2025:3773](https://patchblox.com/security/data/fix/linux/rlsa-2025-3773.md) | Jul 29, 2025 |
| Linux | go-toolset RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | go-toolset almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | go-toolset ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | go1.22 opensuse-leap 15.6 | 1.22.12-150000.1.42.1 | [SUSE-SU-2025:0392-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0392-1.md) | Feb 10, 2025 |
| Linux | go1.22 sles 15.6 | 1.22.12-150000.1.42.1 | [SUSE-SU-2025:0392-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0392-1.md) | Feb 10, 2025 |
| Linux | go1.23 opensuse-leap 15.6 | 1.23.6-150000.1.21.1 | [SUSE-SU-2025:0393-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0393-1.md) | Feb 10, 2025 |
| Linux | go1.23 sles 15.6 | 1.23.6-150000.1.21.1 | [SUSE-SU-2025:0393-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0393-1.md) | Feb 10, 2025 |
| Linux | go1.23-openssl opensuse-leap 15.6 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 |
| Linux | go1.23-openssl sles 15.6 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 |
| Linux | go1.23-openssl sles 15.7 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 |
| Linux | go1.24 opensuse-leap 15.6 | 1.24rc3-150000.1.6.1 | [SUSE-SU-2025:0431-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0431-1.md) | Feb 11, 2025 |
| Linux | go1.24 sles 15.6 | 1.24rc3-150000.1.6.1 | [SUSE-SU-2025:0431-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0431-1.md) | Feb 11, 2025 |
| Linux | golang RHEL 10 | 1.23.7-1.el10_0 | [RHSA-2025:7466](https://patchblox.com/security/data/fix/linux/rhsa-2025-7466.md) | Feb 6, 2025 |
| Linux | golang RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | golang ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | golang rocky 10 | 0:1.23.7-1.el10_0 | [RLSA-2025:7466](https://patchblox.com/security/data/fix/linux/rlsa-2025-7466.md) | Oct 3, 2025 |
| Linux | golang rocky 9 | 0:1.23.6-2.el9_6 | [RLSA-2025:3773](https://patchblox.com/security/data/fix/linux/rlsa-2025-3773.md) | Jul 29, 2025 |
| Linux | golang-1.22 Ubuntu 22.04.1 LTS (jammy) | 1.22.2-2~22.04.3 | [golang-1.22 1.22.2-2~22.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-golang-1.22-1.22.2-2-22.04.3.md) | Jun 11, 2025 |
| Linux | golang-1.22 Ubuntu 24.04.5 LTS (noble) | 1.22.2-2ubuntu0.4 | [golang-1.22 1.22.2-2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-golang-1.22-1.22.2-2ubuntu0.4.md) | Jun 11, 2025 |
| Linux | golang-1.22 Ubuntu 24.10 (oracular) | 1.22.8-1ubuntu0.1 | [golang-1.22 1.22.8-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-golang-1.22-1.22.8-1ubuntu0.1.md) | Jan 16, 2026 |
| Linux | golang-1.22-go Ubuntu 22.04.1 LTS (jammy) | 1.22.2-2~22.04.3 | [golang-1.22-go 1.22.2-2~22.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-golang-1.22-go-1.22.2-2-22.04.3.md) | Jun 11, 2025 |
| Linux | golang-1.22-go Ubuntu 24.04.5 LTS (noble) | 1.22.2-2ubuntu0.4 | [golang-1.22-go 1.22.2-2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-golang-1.22-go-1.22.2-2ubuntu0.4.md) | Jun 11, 2025 |
| Linux | golang-1.22-go Ubuntu 24.10 (oracular) | 1.22.8-1ubuntu0.1 | [golang-1.22-go 1.22.8-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-golang-1.22-go-1.22.8-1ubuntu0.1.md) | Jan 16, 2026 |
| Linux | golang-1.22-src Ubuntu 22.04.1 LTS (jammy) | 1.22.2-2~22.04.3 | [golang-1.22-src 1.22.2-2~22.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-golang-1.22-src-1.22.2-2-22.04.3.md) | Jun 11, 2025 |
| Linux | golang-1.22-src Ubuntu 24.04.5 LTS (noble) | 1.22.2-2ubuntu0.4 | [golang-1.22-src 1.22.2-2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-golang-1.22-src-1.22.2-2ubuntu0.4.md) | Jun 11, 2025 |
| Linux | golang-1.22-src Ubuntu 24.10 (oracular) | 1.22.8-1ubuntu0.1 | [golang-1.22-src 1.22.8-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-golang-1.22-src-1.22.8-1ubuntu0.1.md) | Jan 16, 2026 |
| Linux | golang-1.24 Debian 13.5 (trixie) | 1.24~rc3-1 | [DEBIAN-CVE-2025-22866](https://patchblox.com/security/data/fix/linux/debian-cve-2025-22866.md) | Feb 6, 2025 |
| Linux | golang-bin RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang-bin almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | golang-bin ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | golang-docs RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang-docs almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | golang-docs ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | golang-misc RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang-misc almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | golang-misc ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | golang-race RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang-src RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang-src almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | golang-src ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | golang-tests RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang-tests almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | golang-tests ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | govulncheck-vulndb opensuse-leap 15.6 | 0.0.20250207T224745-150000.1.32.1 | [SUSE-SU-2025:0429-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0429-1.md) | Feb 11, 2025 |
| Linux | govulncheck-vulndb sles 15.6 | 0.0.20250207T224745-150000.1.32.1 | [SUSE-SU-2025:0429-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0429-1.md) | Feb 11, 2025 |
| Linux | osbuild-composer RHEL 8 | 0:101.5-3.el8_10 | [RHSA-2026:67148](https://patchblox.com/security/data/fix/linux/rhsa-2026-67148.md) | Sep 19, 2026 |
| Linux | osbuild-composer almalinux 8 | 101.5-3.el8_10.alma.1 | [ALSA-2026:67148](https://patchblox.com/security/data/fix/linux/alsa-2026-67148.md) | Sep 14, 2026 |
| Linux | osbuild-composer ol 8 | 0:101.5-3.0.1.el8_10 | [ELSA-2026-67148-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67148-0.md) | Sep 28, 2026 |
| Linux | osbuild-composer rocky 8 | 0:101.5-3.el8_10.rocky.0.6 | [RLSA-2026:67148](https://patchblox.com/security/data/fix/linux/rlsa-2026-67148.md) | Sep 15, 2026 |
| Linux | osbuild-composer-core RHEL 8 | 0:101.5-3.el8_10 | [RHSA-2026:67148](https://patchblox.com/security/data/fix/linux/rhsa-2026-67148.md) | Sep 19, 2026 |
| Linux | osbuild-composer-core almalinux 8 | 101.5-3.el8_10.alma.1 | [ALSA-2026:67148](https://patchblox.com/security/data/fix/linux/alsa-2026-67148.md) | Sep 14, 2026 |
| Linux | osbuild-composer-core ol 8 | 0:101.5-3.0.1.el8_10 | [ELSA-2026-67148-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67148-0.md) | Sep 28, 2026 |
| Linux | osbuild-composer-worker RHEL 8 | 0:101.5-3.el8_10 | [RHSA-2026:67148](https://patchblox.com/security/data/fix/linux/rhsa-2026-67148.md) | Sep 19, 2026 |
| Linux | osbuild-composer-worker almalinux 8 | 101.5-3.el8_10.alma.1 | [ALSA-2026:67148](https://patchblox.com/security/data/fix/linux/alsa-2026-67148.md) | Sep 14, 2026 |
| Linux | osbuild-composer-worker ol 8 | 0:101.5-3.0.1.el8_10 | [ELSA-2026-67148-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67148-0.md) | Sep 28, 2026 |
| Linux | rhc RHEL 9 | 1:0.2.6-3.el9_6 | [RHSA-2025:7326](https://patchblox.com/security/data/fix/linux/rhsa-2025-7326.md) | May 13, 2025 |
| Linux | rhc-devel RHEL 9 | 1:0.2.6-3.el9_6 | [RHSA-2025:7326](https://patchblox.com/security/data/fix/linux/rhsa-2025-7326.md) | May 13, 2025 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.