# CVE-2025-27144: osbuild-composer: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood

CVE-2025-27144 is fixed in 29 products on 1 platform, first by RHSA-2025:7459, released February 24, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-27144
- Priority: High
- CVSS: 7.5 (Moderate)
- EPSS: 0.0040
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 24, 2025

## Description

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.  Security Fix(es):  * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | apptainer opensuse-leap 15.6 | 1.4.5-150600.4.12.1 | [SUSE-SU-2026:0439-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0439-1.md) | Feb 11, 2026 |
| Linux | apptainer opensuse-leap 15.6 | 1.3.6-150600.4.9.1 | [SUSE-SU-2025:0980-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0980-1.md) | Mar 21, 2025 |
| Linux | apptainer sles 15.6 | 1.3.6-150600.4.9.1 | [SUSE-SU-2025:0980-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0980-1.md) | Mar 21, 2025 |
| Linux | apptainer sles 15.7 | 1.4.5-150600.4.12.1 | [SUSE-SU-2026:0439-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0439-1.md) | Feb 11, 2026 |
| Linux | buildah RHEL 10 | 1.39.4-1.el10_0 | [RHSA-2025:7459](https://patchblox.com/security/data/fix/linux/rhsa-2025-7459.md) | Feb 24, 2025 |
| Linux | buildah RHEL 9 | 2:1.39.4-1.el9_6 | [RHSA-2025:7389](https://patchblox.com/security/data/fix/linux/rhsa-2025-7389.md) | May 13, 2025 |
| Linux | buildah almalinux 10 | 2:1.39.4-1.el10_0 | [ALSA-2025:7459](https://patchblox.com/security/data/fix/linux/alsa-2025-7459.md) | May 13, 2025 |
| Linux | buildah almalinux 9 | 2:1.39.4-1.el9_6 | [ALSA-2025:7389](https://patchblox.com/security/data/fix/linux/alsa-2025-7389.md) | May 13, 2025 |
| Linux | buildah ol 10 | 2:1.39.4-2.0.1.el10_0 | [ELSA-2025-7459](https://patchblox.com/security/data/fix/linux/elsa-2025-7459.md) | Jul 7, 2025 |
| Linux | buildah ol 9 | 2:1.39.4-1.0.1.el9_6 | [ELSA-2025-7389](https://patchblox.com/security/data/fix/linux/elsa-2025-7389.md) | May 21, 2025 |
| Linux | buildah opensuse-leap 15.6 | 1.35.5-150500.3.34.1 | [SUSE-SU-2025:1018-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1018-1.md) | Mar 26, 2025 |
| Linux | buildah rocky 10 | 2:1.39.4-1.el10_0 | [RLSA-2025:7459](https://patchblox.com/security/data/fix/linux/rlsa-2025-7459.md) | Oct 3, 2025 |
| Linux | buildah rocky 9 | 2:1.39.4-1.el9_6 | [RLSA-2025:7389](https://patchblox.com/security/data/fix/linux/rlsa-2025-7389.md) | Oct 4, 2025 |
| Linux | buildah sles 15.6 | 1.35.5-150500.3.62.1 | [SUSE-SU-2026:2733-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2733-1.md) | Jul 2, 2026 |
| Linux | buildah sles 15.7 | 1.35.5-150500.3.62.1 | [SUSE-SU-2026:2733-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2733-1.md) | Jul 2, 2026 |
| Linux | buildah-tests RHEL 9 | 2:1.39.4-1.el9_6 | [RHSA-2025:7389](https://patchblox.com/security/data/fix/linux/rhsa-2025-7389.md) | May 13, 2025 |
| Linux | buildah-tests almalinux 10 | 2:1.39.4-1.el10_0 | [ALSA-2025:7459](https://patchblox.com/security/data/fix/linux/alsa-2025-7459.md) | May 13, 2025 |
| Linux | buildah-tests almalinux 9 | 2:1.39.4-1.el9_6 | [ALSA-2025:7389](https://patchblox.com/security/data/fix/linux/alsa-2025-7389.md) | May 13, 2025 |
| Linux | buildah-tests ol 10 | 2:1.39.4-2.0.1.el10_0 | [ELSA-2025-7459](https://patchblox.com/security/data/fix/linux/elsa-2025-7459.md) | Jul 7, 2025 |
| Linux | buildah-tests ol 9 | 2:1.39.4-1.0.1.el9_6 | [ELSA-2025-7389](https://patchblox.com/security/data/fix/linux/elsa-2025-7389.md) | May 21, 2025 |
| Linux | containerd amzn 2023 | 1.7.27-1.amzn2023.0.2 | [ALAS2023-2025-930](https://patchblox.com/security/data/fix/linux/alas2023-2025-930.md) | Apr 9, 2025 |
| Linux | containerd-debuginfo amzn 2023 | 1.7.27-1.amzn2023.0.2 | [ALAS2023-2025-930](https://patchblox.com/security/data/fix/linux/alas2023-2025-930.md) | Apr 9, 2025 |
| Linux | containerd-debugsource amzn 2023 | 1.7.27-1.amzn2023.0.2 | [ALAS2023-2025-930](https://patchblox.com/security/data/fix/linux/alas2023-2025-930.md) | Apr 9, 2025 |
| Linux | containerd-stress amzn 2023 | 1.7.27-1.amzn2023.0.2 | [ALAS2023-2025-930](https://patchblox.com/security/data/fix/linux/alas2023-2025-930.md) | Apr 9, 2025 |
| Linux | containerd-stress-debuginfo amzn 2023 | 1.7.27-1.amzn2023.0.2 | [ALAS2023-2025-930](https://patchblox.com/security/data/fix/linux/alas2023-2025-930.md) | Apr 9, 2025 |
| Linux | cosign opensuse-leap 15.6 | 2.5.0-150400.3.27.1 | [SUSE-SU-2025:1333-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1333-1.md) | Apr 17, 2025 |
| Linux | cosign sles 15.6 | 2.5.0-150400.3.27.1 | [SUSE-SU-2025:1333-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1333-1.md) | Apr 17, 2025 |
| Linux | gh opensuse-leap 16.0 | 2.96.0-bp160.1.1 | [OPENSUSE-SU-2026:21310-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21310-1.md) | Jul 10, 2026 |
| Linux | golang-github-go-jose-go-jose Debian 13.5 (trixie) | 4.0.5-1 | [DEBIAN-CVE-2025-27144](https://patchblox.com/security/data/fix/linux/debian-cve-2025-27144.md) | Feb 24, 2025 |
| Linux | golang-github-go-jose-go-jose Debian 14 | 4.0.5-1 | [DEBIAN-CVE-2025-27144](https://patchblox.com/security/data/fix/linux/debian-cve-2025-27144.md) | Feb 24, 2025 |
| Linux | grafana opensuse-leap 15.6 | 10.4.15-150200.3.67.1 | [SUSE-SU-2025:1011-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1011-1.md) | Mar 25, 2025 |
| Linux | grafana sles 15.6 | 10.4.15-150200.3.69.1 | [SUSE-SU-2025:1011-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1011-1.md) | Mar 25, 2025 |
| Linux | nerdctl amzn 2023 | 2.0.4-1.amzn2023.0.1 | [ALAS2023-2025-931](https://patchblox.com/security/data/fix/linux/alas2023-2025-931.md) | Apr 9, 2025 |
| Linux | opentelemetry-collector RHEL 10 | 0.107.0-9.el10_0 | [RHSA-2025:7479](https://patchblox.com/security/data/fix/linux/rhsa-2025-7479.md) | Mar 21, 2025 |
| Linux | opentelemetry-collector RHEL 9 | 0:0.107.0-8.el9_6 | [RHSA-2025:7407](https://patchblox.com/security/data/fix/linux/rhsa-2025-7407.md) | May 13, 2025 |
| Linux | opentelemetry-collector rocky 10 | 0:0.107.0-9.el10_0 | [RLSA-2025:7479](https://patchblox.com/security/data/fix/linux/rlsa-2025-7479.md) | Oct 3, 2025 |
| Linux | osbuild-composer RHEL 10 | 134.1-3.el10_0 | [RHSA-2025:19566](https://patchblox.com/security/data/fix/linux/rhsa-2025-19566.md) | Feb 24, 2025 |
| Linux | osbuild-composer RHEL 9 | 0:132.2-3.el9_6 | [RHSA-2025:19594](https://patchblox.com/security/data/fix/linux/rhsa-2025-19594.md) | Nov 4, 2025 |
| Linux | osbuild-composer almalinux 10 | 134.1-3.el10_0.alma.1 | [ALSA-2025:19566](https://patchblox.com/security/data/fix/linux/alsa-2025-19566.md) | Nov 4, 2025 |
| Linux | osbuild-composer ol 10 | 0:134.1-3.0.1.el10_0 | [ELSA-2025-19566](https://patchblox.com/security/data/fix/linux/elsa-2025-19566.md) | Nov 4, 2025 |
| Linux | osbuild-composer ol 9 | 0:132.2-3.0.1.el9_6 | [ELSA-2025-19594](https://patchblox.com/security/data/fix/linux/elsa-2025-19594.md) | Nov 5, 2025 |
| Linux | osbuild-composer-core RHEL 9 | 0:132.2-3.el9_6 | [RHSA-2025:19594](https://patchblox.com/security/data/fix/linux/rhsa-2025-19594.md) | Nov 4, 2025 |
| Linux | osbuild-composer-core almalinux 10 | 134.1-3.el10_0.alma.1 | [ALSA-2025:19566](https://patchblox.com/security/data/fix/linux/alsa-2025-19566.md) | Nov 4, 2025 |
| Linux | osbuild-composer-core ol 10 | 0:134.1-3.0.1.el10_0 | [ELSA-2025-19566](https://patchblox.com/security/data/fix/linux/elsa-2025-19566.md) | Nov 4, 2025 |
| Linux | osbuild-composer-core ol 9 | 0:132.2-3.0.1.el9_6 | [ELSA-2025-19594](https://patchblox.com/security/data/fix/linux/elsa-2025-19594.md) | Nov 5, 2025 |
| Linux | osbuild-composer-worker RHEL 9 | 0:132.2-3.el9_6 | [RHSA-2025:19594](https://patchblox.com/security/data/fix/linux/rhsa-2025-19594.md) | Nov 4, 2025 |
| Linux | osbuild-composer-worker almalinux 10 | 134.1-3.el10_0.alma.1 | [ALSA-2025:19566](https://patchblox.com/security/data/fix/linux/alsa-2025-19566.md) | Nov 4, 2025 |
| Linux | osbuild-composer-worker ol 10 | 0:134.1-3.0.1.el10_0 | [ELSA-2025-19566](https://patchblox.com/security/data/fix/linux/elsa-2025-19566.md) | Nov 4, 2025 |
| Linux | osbuild-composer-worker ol 9 | 0:132.2-3.0.1.el9_6 | [ELSA-2025-19594](https://patchblox.com/security/data/fix/linux/elsa-2025-19594.md) | Nov 5, 2025 |
| Linux | podman RHEL 10 | 5.4.0-9.el10_0 | [RHSA-2025:7462](https://patchblox.com/security/data/fix/linux/rhsa-2025-7462.md) | Feb 26, 2025 |
| Linux | podman RHEL 9 | 5:5.4.0-9.el9_6 | [RHSA-2025:7391](https://patchblox.com/security/data/fix/linux/rhsa-2025-7391.md) | May 13, 2025 |
| Linux | podman almalinux 10 | 6:5.4.0-9.el10_0 | [ALSA-2025:7462](https://patchblox.com/security/data/fix/linux/alsa-2025-7462.md) | May 13, 2025 |
| Linux | podman ol 10 | 6:5.4.0-10.0.1.el10_0 | [ELSA-2025-7462](https://patchblox.com/security/data/fix/linux/elsa-2025-7462.md) | Jun 30, 2025 |
| Linux | podman ol 9 | 5:5.4.0-9.0.1.el9_6 | [ELSA-2025-7391](https://patchblox.com/security/data/fix/linux/elsa-2025-7391.md) | May 21, 2025 |
| Linux | podman opensuse-leap 15.6 | 4.9.5-150500.3.43.2 | [SUSE-RU-2025:02093-1](https://patchblox.com/security/data/fix/linux/suse-ru-2025-02093-1.md) | Jun 24, 2025 |
| Linux | podman rocky 10 | 6:5.4.0-9.el10_0 | [RLSA-2025:7462](https://patchblox.com/security/data/fix/linux/rlsa-2025-7462.md) | Oct 3, 2025 |
| Linux | podman rocky 9 | 5:5.4.0-9.el9_6 | [RLSA-2025:7391](https://patchblox.com/security/data/fix/linux/rlsa-2025-7391.md) | Oct 4, 2025 |
| Linux | podman sles 15.6 | 4.9.5-150500.3.43.2 | [SUSE-RU-2025:02093-1](https://patchblox.com/security/data/fix/linux/suse-ru-2025-02093-1.md) | Jun 24, 2025 |
| Linux | podman sles 15.7 | 4.9.5-150500.3.43.2 | [SUSE-RU-2025:02093-1](https://patchblox.com/security/data/fix/linux/suse-ru-2025-02093-1.md) | Jun 24, 2025 |
| Linux | podman-docker RHEL 9 | 5:5.4.0-9.el9_6 | [RHSA-2025:7391](https://patchblox.com/security/data/fix/linux/rhsa-2025-7391.md) | May 13, 2025 |
| Linux | podman-docker almalinux 10 | 6:5.4.0-9.el10_0 | [ALSA-2025:7462](https://patchblox.com/security/data/fix/linux/alsa-2025-7462.md) | May 13, 2025 |
| Linux | podman-docker ol 10 | 6:5.4.0-10.0.1.el10_0 | [ELSA-2025-7462](https://patchblox.com/security/data/fix/linux/elsa-2025-7462.md) | Jun 30, 2025 |
| Linux | podman-docker ol 9 | 5:5.4.0-9.0.1.el9_6 | [ELSA-2025-7391](https://patchblox.com/security/data/fix/linux/elsa-2025-7391.md) | May 21, 2025 |
| Linux | podman-plugins RHEL 9 | 5:5.4.0-9.el9_6 | [RHSA-2025:7391](https://patchblox.com/security/data/fix/linux/rhsa-2025-7391.md) | May 13, 2025 |
| Linux | podman-plugins ol 9 | 5:5.4.0-9.0.1.el9_6 | [ELSA-2025-7391](https://patchblox.com/security/data/fix/linux/elsa-2025-7391.md) | May 21, 2025 |
| Linux | podman-remote RHEL 9 | 5:5.4.0-9.el9_6 | [RHSA-2025:7391](https://patchblox.com/security/data/fix/linux/rhsa-2025-7391.md) | May 13, 2025 |
| Linux | podman-remote almalinux 10 | 6:5.4.0-9.el10_0 | [ALSA-2025:7462](https://patchblox.com/security/data/fix/linux/alsa-2025-7462.md) | May 13, 2025 |
| Linux | podman-remote ol 10 | 6:5.4.0-10.0.1.el10_0 | [ELSA-2025-7462](https://patchblox.com/security/data/fix/linux/elsa-2025-7462.md) | Jun 30, 2025 |
| Linux | podman-remote ol 9 | 5:5.4.0-9.0.1.el9_6 | [ELSA-2025-7391](https://patchblox.com/security/data/fix/linux/elsa-2025-7391.md) | May 21, 2025 |
| Linux | podman-tests RHEL 9 | 5:5.4.0-9.el9_6 | [RHSA-2025:7391](https://patchblox.com/security/data/fix/linux/rhsa-2025-7391.md) | May 13, 2025 |
| Linux | podman-tests almalinux 10 | 6:5.4.0-9.el10_0 | [ALSA-2025:7462](https://patchblox.com/security/data/fix/linux/alsa-2025-7462.md) | May 13, 2025 |
| Linux | podman-tests ol 10 | 6:5.4.0-10.0.1.el10_0 | [ELSA-2025-7462](https://patchblox.com/security/data/fix/linux/elsa-2025-7462.md) | Jun 30, 2025 |
| Linux | podman-tests ol 9 | 5:5.4.0-9.0.1.el9_6 | [ELSA-2025-7391](https://patchblox.com/security/data/fix/linux/elsa-2025-7391.md) | May 21, 2025 |
| Linux | rekor opensuse-leap 15.6 | 1.3.10-150400.4.25.1 | [SUSE-SU-2025:1332-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1332-1.md) | Apr 17, 2025 |
| Linux | rekor sles 15.6 | 1.3.10-150400.4.25.1 | [SUSE-SU-2025:1332-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1332-1.md) | Apr 17, 2025 |
| Linux | runfinch-finch amzn 2023 | 1.7.1-1.amzn2023.0.1 | [ALAS2023-2025-914](https://patchblox.com/security/data/fix/linux/alas2023-2025-914.md) | Mar 26, 2025 |
| Linux | skopeo RHEL 10 | 1.18.1-1.el10_0 | [RHSA-2025:7467](https://patchblox.com/security/data/fix/linux/rhsa-2025-7467.md) | Feb 24, 2025 |
| Linux | skopeo RHEL 9 | 2:1.18.1-1.el9_6 | [RHSA-2025:7397](https://patchblox.com/security/data/fix/linux/rhsa-2025-7397.md) | May 13, 2025 |
| Linux | skopeo almalinux 10 | 2:1.18.1-1.el10_0 | [ALSA-2025:7467](https://patchblox.com/security/data/fix/linux/alsa-2025-7467.md) | May 13, 2025 |
| Linux | skopeo almalinux 9 | 2:1.18.1-1.el9_6 | [ALSA-2025:7397](https://patchblox.com/security/data/fix/linux/alsa-2025-7397.md) | May 13, 2025 |
| Linux | skopeo ol 10 | 2:1.18.1-2.el10_0 | [ELSA-2025-7467](https://patchblox.com/security/data/fix/linux/elsa-2025-7467.md) | Jul 1, 2025 |
| Linux | skopeo ol 9 | 2:1.18.1-1.el9_6 | [ELSA-2025-7397](https://patchblox.com/security/data/fix/linux/elsa-2025-7397.md) | May 21, 2025 |
| Linux | skopeo opensuse-leap 15.6 | 1.14.4-150300.11.19.1 | [SUSE-SU-2025:0772-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0772-1.md) | Mar 3, 2025 |
| Linux | skopeo rocky 10 | 2:1.18.1-1.el10_0 | [RLSA-2025:7467](https://patchblox.com/security/data/fix/linux/rlsa-2025-7467.md) | Oct 3, 2025 |
| Linux | skopeo rocky 9 | 2:1.18.1-1.el9_6 | [RLSA-2025:7397](https://patchblox.com/security/data/fix/linux/rlsa-2025-7397.md) | Oct 4, 2025 |
| Linux | skopeo sles 15.6 | 1.14.4-150300.11.19.1 | [SUSE-SU-2025:0772-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0772-1.md) | Mar 3, 2025 |
| Linux | skopeo-tests RHEL 9 | 2:1.18.1-1.el9_6 | [RHSA-2025:7397](https://patchblox.com/security/data/fix/linux/rhsa-2025-7397.md) | May 13, 2025 |
| Linux | skopeo-tests almalinux 10 | 2:1.18.1-1.el10_0 | [ALSA-2025:7467](https://patchblox.com/security/data/fix/linux/alsa-2025-7467.md) | May 13, 2025 |
| Linux | skopeo-tests almalinux 9 | 2:1.18.1-1.el9_6 | [ALSA-2025:7397](https://patchblox.com/security/data/fix/linux/alsa-2025-7397.md) | May 13, 2025 |
| Linux | skopeo-tests ol 10 | 2:1.18.1-2.el10_0 | [ELSA-2025-7467](https://patchblox.com/security/data/fix/linux/elsa-2025-7467.md) | Jul 1, 2025 |
| Linux | skopeo-tests ol 9 | 2:1.18.1-1.el9_6 | [ELSA-2025-7397](https://patchblox.com/security/data/fix/linux/elsa-2025-7397.md) | May 21, 2025 |
| Linux | squashfuse opensuse-leap 15.6 | 0.5.0-150600.3.2.1 | [SUSE-SU-2026:0439-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0439-1.md) | Feb 11, 2026 |
| Linux | squashfuse sles 15.7 | 0.5.0-150600.3.2.1 | [SUSE-SU-2026:0439-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0439-1.md) | Feb 11, 2026 |
| Linux | trivy opensuse-leap 15.6 | 0.59.1-bp156.2.9.1 | [OPENSUSE-SU-2025:0080-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2025-0080-1.md) | Mar 3, 2025 |
| Linux | vexctl opensuse-leap 15.6 | 0.4.1+git78.f951e3a-150000.1.11.1 | [SUSE-SU-2026:0592-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0592-1.md) | Feb 20, 2026 |
| Linux | vexctl opensuse-leap 16.0 | 0.4.4+git20.5d61136-160000.1.1 | [OPENSUSE-SU-2026:21481-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21481-1.md) | Jul 30, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.