P5Verified

Red Hat Security Advisory: osbuild-composer security update

CVE-2026-32281, CVE-2026-33810, CVE-2026-33811, CVE-2026-33818, CVE-2026-34986, CVE-2026-39821, CVE-2026-56860, CVE-2026-56862 affects git-lfs. EPSS 0.00355 (percentile 0.26972), scored 2026-10-03. Fixed version: 0:3.6.1-2.el9_6.7. Fixed version: 0:3.6.1-2.el9_6.7. Fixed version: 0:3.6.1-2.el9_6.7. Fixed version: 0:3.6.1-2.el10_0.7. Fixed version: 0:3.6.1-2.el10_0.7. Fixed version: 0:3.6.1-2.el10_0.7. Fixed version: 0:132.2-8.el9_6. Fixed version: 0:132.2-8.el9_6. Fixed version: 0:132.2-8.el9_6. Fixed version: 0:132.2-8.el9_6. Fixed version: 0:132.2-8.el9_6. Fixed version: 0:132.2-8.el9_6.

CVE: CVE-2026-32281, CVE-2026-33810, CVE-2026-33811, CVE-2026-33818, CVE-2026-34986, CVE-2026-39821, CVE-2026-56860, CVE-2026-56862
Product: git-lfs
CCR priority: 0.1 /100 (P5)
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H · OSV.dev
EPSS: 0.00355 · percentile 0.26972 · 2026-10-03
KEV: no

Affected products

git-lfs · Fixed version: 0:3.6.1-2.el9_6.7
git-lfs-debuginfo · Fixed version: 0:3.6.1-2.el9_6.7
git-lfs-debugsource · Fixed version: 0:3.6.1-2.el9_6.7
git-lfs · Fixed version: 0:3.6.1-2.el10_0.7
git-lfs-debuginfo · Fixed version: 0:3.6.1-2.el10_0.7
git-lfs-debugsource · Fixed version: 0:3.6.1-2.el10_0.7
osbuild-composer · Fixed version: 0:132.2-8.el9_6
osbuild-composer-core · Fixed version: 0:132.2-8.el9_6
osbuild-composer-core-debuginfo · Fixed version: 0:132.2-8.el9_6
osbuild-composer-debuginfo · Fixed version: 0:132.2-8.el9_6
osbuild-composer-debugsource · Fixed version: 0:132.2-8.el9_6
osbuild-composer-tests-debuginfo · Fixed version: 0:132.2-8.el9_6
osbuild-composer-worker · Fixed version: 0:132.2-8.el9_6
osbuild-composer-worker-debuginfo · Fixed version: 0:132.2-8.el9_6

Provenance

OSV.dev · Source record · observed 2026-10-04 13:35:46.972631+00:00 UTC
OSV.dev · Source record · observed 2026-10-04 13:35:46.972631+00:00 UTC
OSV.dev · Source record · observed 2026-10-04 13:35:46.972631+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-32281.html