Red Hat Security Advisory: osbuild-composer security update

Fixed packages 8

Vulnerabilities 5

• High 7.5
  CVE-2026-55677

  Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

  Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before res…

  labstack echo temporal temporal-ui-server Debian Ubuntu Wolfi Go
  Jun 26, 2026
• Medium 6.1
  CVE-2026-25681

  Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

  Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

  golang.org/x/net golang.org/x/net/html zot kots Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• Medium 6.1
  CVE-2026-27136

  Invoking duplicate attributes can cause XSS in golang.org/x/net/html

  Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

  golang.org/x/net golang.org/x/net/html zot kots Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• Medium 6.1
  CVE-2026-42502

  Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

  Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

  golang.org/x/net golang.org/x/net/html zot kots Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026
• Medium 5.3
  CVE-2026-41178

  OpenTelemetry-Go's baggage parsing no longer caps raw header length

  OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 a…

  open-telemetry go.opentelemetry.io/otel/propagation go.opentelemetry.io/otel/baggage zot Debian Ubuntu Wolfi Go
  Jun 4, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480757
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480761
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480762
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484830
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493622
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69293.json
• report
  https://access.redhat.com/security/cve/CVE-2026-25681
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-25681
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-25681
• article
  https://go.dev/cl/781703
• article
  https://go.dev/issue/79574
• article
  https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• advisory
  https://pkg.go.dev/vuln/GO-2026-5029
• report
  https://access.redhat.com/security/cve/CVE-2026-27136
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27136
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27136
• article
  https://go.dev/cl/781685
• article
  https://go.dev/issue/79575
• advisory
  https://pkg.go.dev/vuln/GO-2026-5030
• report
  https://access.redhat.com/security/cve/CVE-2026-41178
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-41178
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-41178
• article
  https://github.com/open-telemetry/opentelemetry-go/pull/7880
• article
  https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835
• report
  https://access.redhat.com/security/cve/CVE-2026-42502
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-42502
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-42502
• article
  https://go.dev/cl/781701
• article
  https://go.dev/issue/79572
• advisory
  https://pkg.go.dev/vuln/GO-2026-5027
• report
  https://access.redhat.com/security/cve/CVE-2026-55677
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-55677
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-55677
• article
  https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq