Skip to content
OpenAdvisories
High RHSA-2026:61585 4 CVEs

Red Hat Security Advisory: osbuild-composer security update

Published Sep 1, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream osbuild-composer 0:76.1-8.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream osbuild-composer-core 0:76.1-8.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream osbuild-composer-core-debuginfo 0:76.1-8.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream osbuild-composer-debuginfo 0:76.1-8.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream osbuild-composer-debugsource 0:76.1-8.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream osbuild-composer-dnf-json 0:76.1-8.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream osbuild-composer-tests-debuginfo 0:76.1-8.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream osbuild-composer-worker 0:76.1-8.el9_2
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream osbuild-composer-worker-debuginfo 0:76.1-8.el9_2

Vulnerabilities 4

  • High 7.5
    CVE-2026-55677

    Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

    Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before res…

    labstack echo temporal temporal-ui-server Debian Ubuntu Wolfi Go
  • Medium 6.1
    CVE-2026-25681

    Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

    golang.org/x/net golang.org/x/net/html zot kots Debian Ubuntu Azure Linux Wolfi Go
  • Medium 6.1
    CVE-2026-27136

    Invoking duplicate attributes can cause XSS in golang.org/x/net/html

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

    golang.org/x/net golang.org/x/net/html zot kots Debian Ubuntu Azure Linux Wolfi Go
  • Medium 6.1
    CVE-2026-42502

    Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

    golang.org/x/net golang.org/x/net/html zot kots Debian Ubuntu Azure Linux Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2480757
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2480761
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2480762
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2493622
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61585.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-25681
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-25681
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-25681
  • article
    https://go.dev/cl/781703
  • article
    https://go.dev/issue/79574
  • article
    https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
  • advisory
    https://pkg.go.dev/vuln/GO-2026-5029
  • report
    https://access.redhat.com/security/cve/CVE-2026-27136
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-27136
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-27136
  • article
    https://go.dev/cl/781685
  • article
    https://go.dev/issue/79575
  • advisory
    https://pkg.go.dev/vuln/GO-2026-5030
  • report
    https://access.redhat.com/security/cve/CVE-2026-42502
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42502
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42502
  • article
    https://go.dev/cl/781701
  • article
    https://go.dev/issue/79572
  • advisory
    https://pkg.go.dev/vuln/GO-2026-5027
  • report
    https://access.redhat.com/security/cve/CVE-2026-55677
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-55677
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-55677
  • article
    https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq