Skip to content
OpenAdvisories
Critical RHSA-2026:27856 2 CVEs

Red Hat Security Advisory: osbuild-composer security update

Published Jun 23, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 7

ReleasePackageFixed in
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 osbuild-composer 0:134.1-9.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 osbuild-composer-core 0:134.1-9.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 osbuild-composer-core-debuginfo 0:134.1-9.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 osbuild-composer-debugsource 0:134.1-9.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 osbuild-composer-tests-debuginfo 0:134.1-9.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 osbuild-composer-worker 0:134.1-9.el10_0
Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 osbuild-composer-worker-debuginfo 0:134.1-9.el10_0

Vulnerabilities 2

  • Critical 9.1
    CVE-2026-33186 Public exploit

    gRPC-Go has an authorization bypass via missing leading slash in :path

    gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

    grpc grpc-go zot kubescape Debian Ubuntu Alpine Wolfi Go
  • High 7.5
    CVE-2026-34986

    Go JOSE affect by a panic in JWE decryption

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

    go-jose go-jose zot kubescape Debian Ubuntu Alpine Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2449833
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2455470
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27856.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-33186
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-33186
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-33186
  • article
    https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3
  • report
    https://access.redhat.com/security/cve/CVE-2026-34986
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-34986
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-34986
  • article
    https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8
  • article
    https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants