{
  "cveId": "CVE-2026-55677",
  "url": "https://patchblox.com/security/cve/CVE-2026-55677",
  "summary": "CVE-2026-55677 is fixed in 4 products on 1 platform, first by RHSA-2026:63134, released June 26, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "osbuild-composer: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood",
  "description": "A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.  \n\nSecurity Fix(es):  \n\n  * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)\n  * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)\n  * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)\n  * github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)\n  * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "published": "2026-06-26T16:15:55Z",
  "severity": "important",
  "cvss": 8.2,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
  "epss": 0.00519,
  "epssPercentile": 0.44384,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "govulncheck-vulndb",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "0.0.20260827T195228-160000.1.1",
      "fix": "OPENSUSE-SU-2026:21761-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21761-1",
      "released": "2026-09-04T12:30:23Z"
    },
    {
      "platform": "linux",
      "product": "govulncheck-vulndb",
      "release": "sles 16.0",
      "fixedVersion": "0.0.20260827T195228-160000.1.1",
      "fix": "SUSE-SU-2026:23625-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23625-1",
      "released": "2026-09-04T12:32:03Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer",
      "release": "RHEL 10",
      "fixedVersion": "134.1-10.el10_0",
      "fix": "RHSA-2026:63134",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-63134",
      "released": "2026-06-26T16:15:55Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer",
      "release": "RHEL 8",
      "fixedVersion": "0:101.5-3.el8_10",
      "fix": "RHSA-2026:67148",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-67148",
      "released": "2026-09-19T18:31:30Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer",
      "release": "RHEL 9",
      "fixedVersion": "0:165.1-5.el9_8",
      "fix": "RHSA-2026:69293",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-69293",
      "released": "2026-09-22T19:09:12Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer",
      "release": "almalinux 10",
      "fixedVersion": "165.1-5.el10_2.alma.1",
      "fix": "ALSA-2026:66432",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-66432",
      "released": "2026-09-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer",
      "release": "almalinux 8",
      "fixedVersion": "101.5-3.el8_10.alma.1",
      "fix": "ALSA-2026:67148",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-67148",
      "released": "2026-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer",
      "release": "almalinux 9",
      "fixedVersion": "165.1-5.el9_8.alma.1",
      "fix": "ALSA-2026:69293",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-69293",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer",
      "release": "ol 10",
      "fixedVersion": "0:176-1.0.3.el10_2",
      "fix": "ELSA-2026-66432-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-66432-0",
      "released": "2026-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer",
      "release": "ol 8",
      "fixedVersion": "0:101.5-3.0.1.el8_10",
      "fix": "ELSA-2026-67148-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-67148-0",
      "released": "2026-09-28T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer",
      "release": "ol 9",
      "fixedVersion": "0:175-1.0.2.el9_8",
      "fix": "ELSA-2026-69293",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-69293",
      "released": "2026-11-07T00:50:51Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer",
      "release": "rocky 10",
      "fixedVersion": "0:165.1-5.el10_2.rocky.0.1",
      "fix": "RLSA-2026:66432",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-66432",
      "released": "2026-09-11T12:09:43Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer",
      "release": "rocky 8",
      "fixedVersion": "0:101.5-3.el8_10.rocky.0.6",
      "fix": "RLSA-2026:67148",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-67148",
      "released": "2026-09-15T06:01:32Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer",
      "release": "rocky 9",
      "fixedVersion": "0:165.1-5.el9_8.rocky.0.1",
      "fix": "RLSA-2026:69293",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-69293",
      "released": "2026-09-22T18:04:11Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-core",
      "release": "RHEL 8",
      "fixedVersion": "0:101.5-3.el8_10",
      "fix": "RHSA-2026:67148",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-67148",
      "released": "2026-09-19T18:31:30Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-core",
      "release": "RHEL 9",
      "fixedVersion": "0:165.1-5.el9_8",
      "fix": "RHSA-2026:69293",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-69293",
      "released": "2026-09-22T19:09:12Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-core",
      "release": "almalinux 10",
      "fixedVersion": "165.1-5.el10_2.alma.1",
      "fix": "ALSA-2026:66432",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-66432",
      "released": "2026-09-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-core",
      "release": "almalinux 8",
      "fixedVersion": "101.5-3.el8_10.alma.1",
      "fix": "ALSA-2026:67148",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-67148",
      "released": "2026-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-core",
      "release": "almalinux 9",
      "fixedVersion": "165.1-5.el9_8.alma.1",
      "fix": "ALSA-2026:69293",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-69293",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-core",
      "release": "ol 10",
      "fixedVersion": "0:176-1.0.3.el10_2",
      "fix": "ELSA-2026-66432-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-66432-0",
      "released": "2026-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-core",
      "release": "ol 8",
      "fixedVersion": "0:101.5-3.0.1.el8_10",
      "fix": "ELSA-2026-67148-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-67148-0",
      "released": "2026-09-28T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-core",
      "release": "ol 9",
      "fixedVersion": "0:175-1.0.2.el9_8",
      "fix": "ELSA-2026-69293",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-69293",
      "released": "2026-11-07T00:50:51Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-worker",
      "release": "RHEL 8",
      "fixedVersion": "0:101.5-3.el8_10",
      "fix": "RHSA-2026:67148",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-67148",
      "released": "2026-09-19T18:31:30Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-worker",
      "release": "RHEL 9",
      "fixedVersion": "0:165.1-5.el9_8",
      "fix": "RHSA-2026:69293",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-69293",
      "released": "2026-09-22T19:09:12Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-worker",
      "release": "almalinux 10",
      "fixedVersion": "165.1-5.el10_2.alma.1",
      "fix": "ALSA-2026:66432",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-66432",
      "released": "2026-09-10T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-worker",
      "release": "almalinux 8",
      "fixedVersion": "101.5-3.el8_10.alma.1",
      "fix": "ALSA-2026:67148",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-67148",
      "released": "2026-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-worker",
      "release": "almalinux 9",
      "fixedVersion": "165.1-5.el9_8.alma.1",
      "fix": "ALSA-2026:69293",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-69293",
      "released": "2026-09-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-worker",
      "release": "ol 10",
      "fixedVersion": "0:176-1.0.3.el10_2",
      "fix": "ELSA-2026-66432-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-66432-0",
      "released": "2026-09-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-worker",
      "release": "ol 8",
      "fixedVersion": "0:101.5-3.0.1.el8_10",
      "fix": "ELSA-2026-67148-0",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-67148-0",
      "released": "2026-09-28T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "osbuild-composer-worker",
      "release": "ol 9",
      "fixedVersion": "0:175-1.0.2.el9_8",
      "fix": "ELSA-2026-69293",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-69293",
      "released": "2026-11-07T00:50:51Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}