Linux · Security advisory · September 10, 2026

RLSA-2026:66016: osbuild-composer security update

RLSA-2026:66016, released September 10, 2026, fixes 10 CVEs in osbuild-composer (version 0:101.5-2.el8_10.rocky.0.6). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
10
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0183
79th percentile

Priority of the 10 CVEs

Patch now 0 Urgent 1 High 9 Routine 0

Fixed package versions

ProductReleaseFixed in
osbuild-composerrocky 80:101.5-2.el8_10.rocky.0.6

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2026-39821 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna 10.0 0.0183 None reported
High CVE-2026-39820 Quadratic string concatentation in consumeComment in net/mail 8.8 0.0078 None reported
High CVE-2024-45336 osbuild-composer: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood 8.2 0.0071 None reported
High CVE-2026-33818 Enforce maximum recursion depth in encoding/asn1 8.8 0.0057 None reported
High CVE-2026-56853 Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http 8.8 0.0057 None reported
High CVE-2026-56859 Add recursion depth guard during decode in encoding/xml 8.8 0.0057 None reported
High CVE-2026-56862 Limit handshake messages we are willing to accept post-handshake in crypto/tls 8.8 0.0057 None reported
High CVE-2026-56860 Avoid quadratic complexity in resolvePath in net/url 8.8 0.0055 None reported
High CVE-2026-56858 Fix Javascript regexp context tracking in html/template 8.8 0.0031 None reported
High CVE-2024-9355 osbuild-composer: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood 8.2 0.0030 None reported
Showing 1 to 10 of 10 1