Skip to content
OpenAdvisories
High RHSA-2026:26054 2 CVEs

Red Hat Security Advisory: osbuild-composer security update

Published Jun 16, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream osbuild-composer 0:132.2-8.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream osbuild-composer-core 0:132.2-8.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream osbuild-composer-core-debuginfo 0:132.2-8.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream osbuild-composer-debuginfo 0:132.2-8.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream osbuild-composer-debugsource 0:132.2-8.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream osbuild-composer-tests-debuginfo 0:132.2-8.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream osbuild-composer-worker 0:132.2-8.el9_6
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream osbuild-composer-worker-debuginfo 0:132.2-8.el9_6

Vulnerabilities 2

  • High 7.5
    CVE-2026-32281

    Inefficient policy validation in crypto/x509

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-34986

    Go JOSE affect by a panic in JWE decryption

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

    go-jose go-jose zot kubescape Debian Ubuntu Alpine Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2455470
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2456333
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26054.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-32281
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-32281
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-32281
  • article
    https://go.dev/cl/758061
  • article
    https://go.dev/issue/78281
  • article
    https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
  • advisory
    https://pkg.go.dev/vuln/GO-2026-4946
  • report
    https://access.redhat.com/security/cve/CVE-2026-34986
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34986
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34986
  • article
    https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8
  • article
    https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants