Summary
[175-1.0.2]
- Rebuild to fix CVE-2026-33818, CVE-2026-39820, CVE-2026-39821, CVE-2026-42499,
CVE-2026-42504, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860,
CVE-2026-56862
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | osbuild-composer | 0:175-1.0.2.el9_8 |
| Oracle Linux · 9 | osbuild-composer-core | 0:175-1.0.2.el9_8 |
| Oracle Linux · 9 | osbuild-composer-worker | 0:175-1.0.2.el9_8 |
Vulnerabilities 5
-
High 7.5
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before res…
-
Medium 6.1
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
-
Medium 6.1
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
-
Medium 6.1
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
-
Medium 5.3
OpenTelemetry-Go's baggage parsing no longer caps raw header length
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 a…