P5Verified

Red Hat Security Advisory: osbuild-composer security, bug fix, and enhancement update

CVE-2026-33810, CVE-2026-33818, CVE-2026-39820, CVE-2026-39821, CVE-2026-41178, CVE-2026-42499, CVE-2026-42504, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862 affects osbuild-composer. EPSS 0.0034 (percentile 0.25193), scored 2026-10-03. Fixed version: 0:134.1-12.el10_0. Fixed version: 0:134.1-12.el10_0. Fixed version: 0:134.1-12.el10_0. Fixed version: 0:134.1-12.el10_0. Fixed version: 0:134.1-12.el10_0. Fixed version: 0:134.1-12.el10_0. Fixed version: 0:134.1-12.el10_0. Fixed version: 0:165.1-3.el10_2.2. Fixed version: 0:165.1-3.el10_2.2.

CVE: CVE-2026-33810, CVE-2026-33818, CVE-2026-39820, CVE-2026-39821, CVE-2026-41178, CVE-2026-42499, CVE-2026-42504, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862
Product: osbuild-composer
CCR priority: 0.1 /100 (P5)
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · OSV.dev
EPSS: 0.0034 · percentile 0.25193 · 2026-10-03
KEV: no

Affected products

osbuild-composer · Fixed version: 0:134.1-12.el10_0
osbuild-composer-core · Fixed version: 0:134.1-12.el10_0
osbuild-composer-core-debuginfo · Fixed version: 0:134.1-12.el10_0
osbuild-composer-debugsource · Fixed version: 0:134.1-12.el10_0
osbuild-composer-tests-debuginfo · Fixed version: 0:134.1-12.el10_0
osbuild-composer-worker · Fixed version: 0:134.1-12.el10_0
osbuild-composer-worker-debuginfo · Fixed version: 0:134.1-12.el10_0
osbuild-composer · Fixed version: 0:165.1-3.el10_2.2
osbuild-composer-core · Fixed version: 0:165.1-3.el10_2.2
osbuild-composer-core-debuginfo · Fixed version: 0:165.1-3.el10_2.2
osbuild-composer-debuginfo · Fixed version: 0:165.1-3.el10_2.2
osbuild-composer-debugsource · Fixed version: 0:165.1-3.el10_2.2
osbuild-composer-tests-debuginfo · Fixed version: 0:165.1-3.el10_2.2
osbuild-composer-worker · Fixed version: 0:165.1-3.el10_2.2
osbuild-composer-worker-debuginfo · Fixed version: 0:165.1-3.el10_2.2
ignition · Fixed version: 0:2.17.0-2.el9_4.2
ignition-debuginfo · Fixed version: 0:2.17.0-2.el9_4.2
ignition-debugsource · Fixed version: 0:2.17.0-2.el9_4.2
ignition-edge · Fixed version: 0:2.17.0-2.el9_4.2
ignition-validate · Fixed version: 0:2.17.0-2.el9_4.2
ignition-validate-debuginfo · Fixed version: 0:2.17.0-2.el9_4.2
ignition · Fixed version: 0:2.15.0-2.el9_2.1
ignition-debuginfo · Fixed version: 0:2.15.0-2.el9_2.1
ignition-debugsource · Fixed version: 0:2.15.0-2.el9_2.1
ignition-edge · Fixed version: 0:2.15.0-2.el9_2.1
ignition-validate · Fixed version: 0:2.15.0-2.el9_2.1
ignition-validate-debuginfo · Fixed version: 0:2.15.0-2.el9_2.1
buildah · Fixed version: 2:1.43.1-5.el10_2
buildah-debuginfo · Fixed version: 2:1.43.1-5.el10_2
buildah-debugsource · Fixed version: 2:1.43.1-5.el10_2
buildah-tests · Fixed version: 2:1.43.1-5.el10_2
buildah-tests-debuginfo · Fixed version: 2:1.43.1-5.el10_2
go-fdo-server · Fixed version: 0:1.0.1-2.el10_2.4
go-fdo-server-debuginfo · Fixed version: 0:1.0.1-2.el10_2.4
go-fdo-server-debugsource · Fixed version: 0:1.0.1-2.el10_2.4
go-fdo-server-manufacturer · Fixed version: 0:1.0.1-2.el10_2.4
go-fdo-server-owner · Fixed version: 0:1.0.1-2.el10_2.4
go-fdo-server-rendezvous · Fixed version: 0:1.0.1-2.el10_2.4
go-fdo-client · Fixed version: 0:1.0.0-4.el10_2.7
go-fdo-client-debuginfo · Fixed version: 0:1.0.0-4.el10_2.7
go-fdo-client-debugsource · Fixed version: 0:1.0.0-4.el10_2.7

Provenance

OSV.dev · Source record · observed 2026-10-04 13:35:46.972631+00:00 UTC
OSV.dev · Source record · observed 2026-10-04 13:35:46.972631+00:00 UTC
OSV.dev · Source record · observed 2026-10-04 13:35:46.972631+00:00 UTC
OSV.dev · Source record · observed 2026-10-04 13:35:46.972631+00:00 UTC
OSV.dev · Source record · observed 2026-10-04 13:35:46.972631+00:00 UTC
OSV.dev · Source record · observed 2026-10-04 13:35:46.972631+00:00 UTC
OSV.dev · Source record · observed 2026-10-04 13:35:46.972631+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-33810.html