Linux · Security advisory · September 13, 2026

RHSA-2026:65153: Security update for 3 packages

RHSA-2026:65153, released September 13, 2026, fixes 10 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
10
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0183
79th percentile

Priority of the 10 CVEs

Patch now 0 Urgent 1 High 9 Routine 0

Fixed package versions

ProductReleaseFixed in
osbuild-composerRHEL 90:165.1-4.el9_8.1
osbuild-composer-coreRHEL 90:165.1-4.el9_8.1
osbuild-composer-workerRHEL 90:165.1-4.el9_8.1

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2026-39821 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna 10.0 0.0183 None reported
High CVE-2026-42499 Quadratic string concatenation in consumePhrase in net/mail 8.8 0.0080 None reported
High CVE-2026-39820 Quadratic string concatentation in consumeComment in net/mail 8.8 0.0078 None reported
High CVE-2026-33818 Enforce maximum recursion depth in encoding/asn1 8.8 0.0057 None reported
High CVE-2026-56853 Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http 8.8 0.0057 None reported
High CVE-2026-56859 Add recursion depth guard during decode in encoding/xml 8.8 0.0057 None reported
High CVE-2026-56862 Limit handshake messages we are willing to accept post-handshake in crypto/tls 8.8 0.0057 None reported
High CVE-2026-42504 Quadratic complexity in WordDecoder.DecodeHeader in mime 8.8 0.0056 None reported
High CVE-2026-56860 Avoid quadratic complexity in resolvePath in net/url 8.8 0.0055 None reported
High CVE-2026-56858 Fix Javascript regexp context tracking in html/template 8.8 0.0031 None reported
Showing 1 to 10 of 10 1