P5Verified

Red Hat Security Advisory: osbuild-composer security update

CVE-2025-22866, CVE-2026-32281, CVE-2026-41178, CVE-2026-42499, CVE-2026-42504, CVE-2026-55677 affects osbuild-composer. EPSS 0.0029 (percentile 0.19559), scored 2026-10-03. Fixed version: 0:101.5-3.el8_10. Fixed version: 0:101.5-3.el8_10. Fixed version: 0:101.5-3.el8_10. Fixed version: 0:101.5-3.el8_10. Fixed version: 0:101.5-3.el8_10. Fixed version: 0:101.5-3.el8_10. Fixed version: 0:101.5-3.el8_10. Fixed version: 0:101.5-3.el8_10.

CVE: CVE-2025-22866, CVE-2026-32281, CVE-2026-41178, CVE-2026-42499, CVE-2026-42504, CVE-2026-55677
Product: osbuild-composer
CCR priority: 0.1 /100 (P5)
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H · OSV.dev
EPSS: 0.0029 · percentile 0.19559 · 2026-10-03
KEV: no

Affected products

osbuild-composer · Fixed version: 0:101.5-3.el8_10
osbuild-composer-core · Fixed version: 0:101.5-3.el8_10
osbuild-composer-core-debuginfo · Fixed version: 0:101.5-3.el8_10
osbuild-composer-debuginfo · Fixed version: 0:101.5-3.el8_10
osbuild-composer-debugsource · Fixed version: 0:101.5-3.el8_10
osbuild-composer-tests-debuginfo · Fixed version: 0:101.5-3.el8_10
osbuild-composer-worker · Fixed version: 0:101.5-3.el8_10
osbuild-composer-worker-debuginfo · Fixed version: 0:101.5-3.el8_10

Provenance

OSV.dev · Source record · observed 2026-10-04 13:35:46.972631+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-22866.html