Linux · Security advisory · September 10, 2026
ALSA-2026:66432: Security update for 3 packages
ALSA-2026:66432, released September 10, 2026, fixes 6 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
6
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0183
79th percentile
Priority of the 6 CVEs
Patch now 0
Urgent 1
High 5
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| osbuild-composer | almalinux 10 | 165.1-5.el10_2.alma.1 |
| osbuild-composer-core | almalinux 10 | 165.1-5.el10_2.alma.1 |
| osbuild-composer-worker | almalinux 10 | 165.1-5.el10_2.alma.1 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | 10.0 | 0.0183 | None reported | |
| High | CVE-2026-55677 | osbuild-composer: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood | 8.2 | 0.0052 | None reported | |
| High | CVE-2026-41178 | opentelemetry-collector: OpenTelemetry-Go is the Go implementation of OpenTelemetry | 8.2 | 0.0034 | None reported | |
| High | CVE-2026-25681 | Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html | 8.7 | 0.0022 | None reported | |
| High | CVE-2026-27136 | Invoking duplicate attributes can cause XSS in golang.org/x/net/html | 8.7 | 0.0022 | None reported | |
| High | CVE-2026-42502 | Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html | 8.2 | 0.0022 | None reported |
Showing 1 to 6 of 6
1